Security Patch Classification in Android Applications Using CodeBERT

Vulnerabilities in Android applications pose significant risks to user data and system security. In practice, vulnerabilities are usually fixed through security patches submitted as code commits in software repositories. However, understanding security patches from commit histories remains challenging, since the security intent of a commit is not always explicitly reflected in its textual description.In this paper, we formulate security patch analysis as a fine-grained multi-class classification problem and propose a CodeBERT-based approach for six-class security patch classification in Android applications. The proposed method leverages pretrained code representations to capture semantic patterns from patches, where each patch is modeled as the combination of added and deleted code segments in the corresponding diff. We construct a manually annotated dataset of security-related patches collected from open-source Android projects and categorize them into six common security types: Network, Auth, Storage, Crypto, Application, and Code.Experimental results show that the proposed method achieves an accuracy of 0.72, a macro-F1 score of 0.72, and a macroAUC of 0.94. These results demonstrate that pretrained code representations are effective for capturing semantic differences in code changes and outperform traditional machine learning baselines in fine-grained security patch classification.