Intelligent vulnerability detection system based on graph structured source code slice

Deqing ZOU; Xiang LI; Minhuan HUANG; Xiang SONG; Hao LI; Weiming LI

doi:10.11959/j.issn.2096-109x.2021088

您当前的位置：

首页 >

文章列表页 >

Intelligent vulnerability detection system based on graph structured source code slice

Papers | 更新时间：2024-06-03

- Intelligent vulnerability detection system based on graph structured source code slice
- Chinese Journal of Network and Information Security Vol. 7, Issue 5, Pages: 113-122(2021)
- 作者机构：
  
  1. 华中科技大学网络空间安全学院，湖北武汉 430074
  2. 信息系统安全技术重点实验室，北京 100101
  3. 华中科技大学软件学院，湖北武汉 430074
  4. 华中科技大学网络与计算中心，湖北武汉 430074
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2021088
  CLC： TP393
- Online First：2021-10，
  
  Published：15 October 2021
- 稿件说明：
移动端阅览
Deqing ZOU, Xiang LI, Minhuan HUANG, et al. Intelligent vulnerability detection system based on graph structured source code slice[J]. Chinese Journal of Network and Information Security, 2021, 7(5): 113-122.
DOI：

Deqing ZOU, Xiang LI, Minhuan HUANG, et al. Intelligent vulnerability detection system based on graph structured source code slice[J]. Chinese Journal of Network and Information Security, 2021, 7(5): 113-122. DOI： 10.11959/j.issn.2096-109x.2021088.

摘要

针对智能化漏洞检测，从源代码程序依赖图中根据漏洞特征提取图结构源代码切片，将图结构切片信息表征后利用图神经网络模型进行漏洞检测工作。实现了切片级的漏洞检测，并在代码行级预测漏洞行位置。为了验证系统的有效性，分别与静态漏洞检测系统、基于序列化文本信息和基于图结构化信息的漏洞检测系统做比较，实验结果表明，所提系统在漏洞检测能力上有较高准确性，并且在漏洞代码行预测工作上有较好表现。

Abstract

For the intelligent vulnerability detection

the system extracts the graph structured source code slices according to the vulnerability characteristics from the program dependency graph of source code

and then presents the graph structured slice information to carry out vulnerability detection by using the graph neural network model.Slice level vulnerability detection was realized and the vulnerability line was located at the code line level.In order to verify the effectiveness of the system

compared with the static vulnerability detection systems

the vulnerability detection system based on serialized text information

and the vulnerability detection system based on graph structured information

the experimental results show that the proposed system has a high accuracy in the vulnerability detection capability and a good performance in the vulnerability code line prediction.

关键词

Keywords

references

李韵 , 黄辰林 , 王中锋 , 等 . 基于机器学习的软件漏洞挖掘方法综述 [J ] . 软件学报 , 2020 , 31 ( 7 ): 2040 - 2061 .

LI Y , HUANG C L , WANG Z F , et al . Survey of software vulnerability mining methods based on machine learning [J ] . Journal of Software , 2020 , 31 ( 7 ): 2040 - 2061 .

陈肇炫 , 邹德清 , 李珍 , 等 . 基于抽象语法树的智能化漏洞检测系统 [J ] . 信息安全学报 , 2020 , 5 ( 4 ): 1 - 13 .

CHEN Z X , ZOU D Q , LI Z , et al . Intelligent vulnerability detection system based on abstract syntax tree [J ] . Journal of Cyber Security , 2020 , 5 ( 4 ): 1 - 13 .

LI Z , ZOU D Q , XU S H , et al . VulDeePecker:a deep learning-based system for vulnerability detection [C ] // The Network and Distributed System Security Symposium . 2018 .

XIAO Y , CHEN B H , YU C D , et al . MVP:Detecting vulnerabilities using patch-enhanced vulnerability signatures [C ] // USENIX Security Symposium . 2018 .

GUSTAVO G , GUILLERMO L G , UZAL L , et al . Toward large-scale vulnerability discovery using machine learning [C ] // The 6th ACM on Conference on Data and Application Security and Privacy (CODASPY'16) . 2016 : 85 - 96 .

STEPHAN N , THOMAS Z , CHRISTIAN H , et al . Predicting vulnerable software components [C ] // 2007 ACM Conference on Computer and Communications Security (CCS'07) . 2007 : 529 - 540 .

FABIAN Y , MARKUS L , KONRAD R . Generalized vulnerability extrapolation using abstract syntax trees [C ] // The 28th Annual Computer Security Applications Conference . 2012 : 359 - 368 .

FABIAN Y , ALWIN M , HUGO G , et al . Automatic inference of search patterns for taint-style vulnerabilities [C ] // IEEE Symposium on Security and Privacy (S＆P'15) . 2015 : 797 - 812 .

ZOU D Q , WANG S J , XU S H , et al . ߤVulDeePecker:a deep learning-based system for multiclass vulnerability detection [J ] . IEEE Transactions on Dependable and Secure Computing , 2021 , 15 ( 5 ): 2224 - 2236 .

LI Z , ZOU D Q , XU S H , et al . VulDeeLocator:a deep learning-based fine-grained vulnerability detector [J ] . IEEE Transactions on Dependable and Secure Computing , 2021 .

LI Z , ZOU D Q , XU S H , et al . SySeVR:a Framework for using deep learning to detect software vulnerabilities [J ] . IEEE Transactions on Dependable and Secure Computing , 2021 .

LIN G J , XIAO W , ZHANG J , et al . Deep Learning-based vulnerable function detection:a benchmark [C ] // The 21st International Conference on Information and Communications Security . 2019 : 219 - 232 .

LIN G J , ZHANG J , LUO W , et al . POSTER:vulnerability discovery with function representation learning from unlabeled projects [C ] // ACM SIGSAC Conference on Computer and Communications Security . 2017 : 2539 - 2541 .

LIN G J , ZHANG J , LUO W , et al . Cross-project transfer representation learning for vulnerable function discovery [J ] . IEEE Trans Industrial Informatics , 2018 , 14 ( 7 ): 329 - 3297 .

LIU S G , LIN G J , QU L Z , et al . CD-VulD:cross-domain vulnerability discovery based on deep domain adaptation [J ] . IEEE Transactions on Dependable and Secure Computing , 2020 .

VAN N , TRUNG L , TUE L , et al . Deep domain adaptation for vulnerable code function identification [C ] // International Joint Conference on Neural Networks . 2019 : 1 - 8 .

REBECCA , LOUISK , LEI H , ET A L . Automated vulnerability detection in source code using deep representation learning [C ] // The 17th IEEE International Conference on Machine Learning and Applications(ICMLA) . 2018 : 757 - 762 .

TIM S , . Machine-learning supported vulnerability detection in source code [C ] // The 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering(ESEC/FSE) . 2019 : 1180 - 1183 .

WANG H T , YE G X , TANG Z Y , et al . Combining graph-based learning with automated data collection for code vulnerability detection [J ] . IEEE Transactions on Dependable and Secure Computing . 2020 .

DUAN X , WU H , JI S L , et al . VulSniper:focus your attention to shoot fine-grained vulnerabilities [C ] // The 28th International Joint Conference on Artificial Intelligence . 2019 : 4665 - 4671 .

ZHOU Y Q , LIU S Q , SIOW J , et al . Devign:effective vulnerability identification by learning comprehensive program semantics via graph neural networks [C ] // Annual Conference on Neural Information Processing Systems(NeurIPS) . 2019 : 10197 - 10207 .

Views

730

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Deep learning vulnerability detection method based on optimized inter-procedural semantics of programs

Phishing website detection based on two-way feature extraction and adaptive fusion

Anomaly detection in DNS: an empirical study

Research progress on detection of software vulnerabilities based on code similarity

FL-IoV: comprehensive intrusion detection method for internet of vehicles based on federated learning

Related Author

Yan LI

Weizhong QIANG

Zhen LI

Deqing ZOU

Hai JIN

Guo Kai

Wang Heng

Ma Ziqiang

Related Institution

Hubei Key Laboratory of Distributed System Security

Services Computing Technology and System Lab, National Engineering Research Center for Big Data Technology

School of Computer Science and Engineering, Huazhong University of Science and Technology

School of Information Engineering, Ningxia University

China Internet Network Information Center

⁰