Vulnerability identification technology research based on project version difference

Cheng HUANG; Mingxu SUN; Renyu DUAN; Susheng WU; Bin CHEN

doi:10.11959/j.issn.2096-109x.2021094

您当前的位置：

首页 >

文章列表页 >

Vulnerability identification technology research based on project version difference

Topic: Security Awareness and Detection Method | 更新时间：2024-06-03

- Vulnerability identification technology research based on project version difference
- Chinese Journal of Network and Information Security Vol. 8, Issue 1, Pages: 52-62(2022)
- 作者机构：
  
  1. 四川大学网络空间安全学院，四川成都 610065
  2. 广西密码学与信息安全重点实验室，广西桂林541000
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2021094
  CLC： TP393
- Online First：2022-02，
  
  Published：15 February 2022
- 稿件说明：
移动端阅览
Cheng HUANG, Mingxu SUN, Renyu DUAN, et al. Vulnerability identification technology research based on project version difference[J]. Chinese Journal of Network and Information Security, 2022, 8(1): 52-62.
DOI：

Cheng HUANG, Mingxu SUN, Renyu DUAN, et al. Vulnerability identification technology research based on project version difference[J]. Chinese Journal of Network and Information Security, 2022, 8(1): 52-62. DOI： 10.11959/j.issn.2096-109x.2021094.

摘要

开源代码托管平台为软件开发行业带来了活力和机遇，但存在诸多安全隐患。开源代码的不规范性、项目依赖库的复杂性、漏洞披露平台收集漏洞的被动性等问题都影响着开源项目及引入开源组件的闭源项目的安全，大部分漏洞修复行为无法及时被察觉和识别，进而将各类项目的安全风险直接暴露给攻击者。为了全面且及时地发现开源项目中的漏洞修复行为，设计并实现了基于项目版本差异性的漏洞识别系统—VpatchFinder。系统自动获取开源项目中的更新代码及内容数据，对更新前后代码和文本描述信息进行提取分析。提出了基于安全行为与代码特征的差异性特征，提取了包括项目注释信息特征组、页面统计特征组、代码统计特征组以及漏洞类型特征组的共 40 个特征构建特征集，采用随机森林算法来训练可识别漏洞的分类器。通过真实漏洞数据进行测试，VpatchFinder 的精确率为 84.35%，准确率为 85.46%，召回率为85.09%，优于其他常见的机器学习算法模型。进一步通过整理的历年部分开源软件 CVE 漏洞数据进行实验，其结果表明 68.07%的软件漏洞能够提前被 VpatchFinder 发现。该研究结果可以为软件安全架构设计、开发及成分分析等领域提供有效技术支撑。

Abstract

The open source code hosting platform has brought power and opportunities to software development

but there are also many security risks.The open source code has poor quality

the dependency libraries of projects are complex and vulnerability collection platforms are inadequate in collecting vulnerabilities.All these problems affect the security of open source projects and complex software with open source complements and most security patches can't be discovered and applied in time.Thus

the hackers could be easily found such vulnerable software.To discover the vulnerability in the open source community fully and timely

a vulnerability identification system based on project version difference was proposed.The update contents of projects in the open source community were collected automatically

then features were defined as security behaviors and code differences from the code and log in patches

40 features including comment information feature group

page statistics feature group

code statistics feature group and vulnerability type feature group were proposed to build feature set.And random forest model was built to learn classifiers for vulnerability identification.The results show that VpatchFinder achieves a precision rate of 0.844

an accuracy rate of 0.855 and a recall rate of 0.851.Besides

68.07% of community vulnerabilities can be early discovered by VpatchFinder in real open source CVE vulnerabilities.This research result can improve the current issue in software security architecture design and development.

关键词

Keywords

references

ALFADEL M , COSTA D E , SHIHAB E , et al . On the use of dependabot security pull requests [C ] // Proceedings of 2021 IEEE/ACM 18th International Conference on Mining Software Repositories (MSR) . 2021 : 254 - 265 .

PASHCHENKO I , PLATE H , PONTA S E , et al . Vulnerable open source dependencies:counting those that matter [C ] // Proceedings of the 12th ACM/IEEE International Symposium on Empirical Software Engineering and Measurement . 2018 : 1 - 10 .

SABETTA A , BEZZI M . A practical approach to the automatic classification of security-relevant commits [C ] // Proceedings of 2018 IEEE International Conference on Software Maintenance and Evolution . 2018 : 579 - 582 .

KAMIYA T , KUSUMOTO S , INOUE K . CCFinder:a multilinguistic token-based code clone detection system for large scale source code [J ] . IEEE Transactions on Software Engineering , 2002 , 28 ( 7 ): 654 - 670 .

LI Z , LU S , MYAGMAR S , et al . CP-Miner:finding copy-paste and related bugs in large-scale software code [J ] . IEEE Transactions on Software Engineering , 2006 , 32 ( 3 ): 176 - 192 .

王雅文 , 姚欣洪 , 宫云战 , 等 . 一种基于代码静态分析的缓冲区溢出检测算法 [J ] . 计算机研究与发展 , 2012 , 49 ( 4 ): 839 - 845 .

WANG Y W , YAO X H , GONG Y Z , et al . A method of buffer overflow detection based on static code analysis [J ] . Journal of Computer Research and Development , 2012 , 49 ( 4 ): 839 - 845 .

王蕾 , 李丰 , 李炼 , 等 . 污点分析技术的原理和实践应用 [J ] . 软件学报 , 2017 , 28 ( 4 ): 860 - 882 .

WANG L , LI F , LI L , et al . Principle and practice of taint analysis [J ] . Journal of Software , 2017 , 28 ( 4 ): 860 - 882 .

YAMAGUCHI F , LOTTMANN M , RIECK K . Generalized vulnerability extrapolation using abstract syntax trees [C ] // Proceedings of the 28th Annual Computer Security Applications Conference . 2012 : 359 - 368 .

LI J Y , ERNST M D . CBCD:cloned buggy code detector [C ] // Proceedings of 2012 34th International Conference on Software Engineering (ICSE) . 2012 : 310 - 320 .

LI Z , ZOU D Q , XU S H , et al . VulDeePecker:a deep learning-based system for vulnerability detection [C ] // Proceedings 2018 Network and Distributed System Security Symposium . 2018 .

TIAN Y , LAWALL J , LO D . Identifying Linux bug fixing patches [C ] // Proceedings of 2012 34th International Conference on Software Engineering (ICSE) . 2012 : 386 - 396 .

PERL H , DECHAND S , SMITH M , et al . VCCFinder:finding potential vulnerabilities in open-source projects to assist code audits [C ] // Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security . 2015 : 426 - 437 .

ZAMAN S , ADAMS B , HASSAN A E . Security versus performance bugs:a case study on Firefox [C ] // Proceedings of the 8th Working Conference on Mining Software Repositories . 2011 : 93 - 102 .

LI F , PAXSON V . A large-scale empirical study of security patches [C ] // Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security . 2017 : 2201 - 2215 .

WANG X D , SUN K , BATCHELLER A , et al . An empirical study of secret security patch in open source software [M ] // Adaptive Autonomous Secure Cyber Systems . 2020 : 269 - 289 .

NEUHAUS S , ZIMMERMANN T , HOLLER C , et al . Predicting vulnerable software components [C ] // Proceedings of the 14th ACM Conference on Computer and Communications Security . 2007 : 529 - 540 .

郑荣锋 , 方勇 , 刘亮 . 基于动态行为指纹的恶意代码同源性分析 [J ] . 四川大学学报(自然科学版) , 2016 , 53 ( 4 ): 793 - 798 .

ZHENG R F , FANG Y , LIU L . Homology analysis of malicious code based on dynamic-behavior fingerprint [J ] . Journal of Sichuan University (Natural Science Edition) , 2016 , 53 ( 4 ): 793 - 798 .

KONG D G , ZHENG Q , CHEN C , et al . ISA:a source code static vulnerability detection system based on data fusion [C ] // Proceedings of the 2nd International ICST Conference on Scalable Information Systems . 2007 :55.

SONNEKALB T , . Machine-learning supported vulnerability detection in source code [C ] // Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering . 2019 : 1180 - 1183 .

李元诚 , 崔亚奇 , 吕俊峰 , 等 . 开源软件漏洞检测的混合深度学习方法 [J ] . 计算机工程与应用 , 2019 , 55 ( 11 ): 52 - 59 .

LI Y C , CUI Y Q , LYU J F , et al . Combined deep learning method for open source software vulnerability detection [J ] . Computer Engineering and Applications , 2019 , 55 ( 11 ): 52 - 59 .

JIANG L X , MISHERGHI G , SU Z D , et al . DECKARD:scalable and accurate tree-based detection of code clones [C ] // Proceedings of 29th International Conference on Software Engineering (ICSE'07) . 2007 : 96 - 105 .

ALON U , ZILBERSTEIN M , LEVY O , et al . code2vec:learning distributed representations of code [J ] . Proceedings of the ACM on Programming Languages , 2019 ,3:40.

LIU C , CHEN C , HAN J W , et al . GPLAG:detection of software plagiarism by program dependence graph analysis [C ] // Proceedings of the 12th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining . 2006 : 872 - 881 .

PHAM N H , NGUYEN T T , NGUYEN H A , et al . Detection of recurring software vulnerabilities [C ] // ASE '10:Proceedings of the IEEE/ACM International Conference on Automated Software Engineering . 2010 : 447 - 456 .

刘凯 , 方勇 , 张磊 , 等 . 基于图卷积网络的恶意代码聚类 [J ] . 四川大学学报(自然科学版) , 2019 , 56 ( 4 ): 654 - 660 .

LIU K , FANG Y , ZHANG L , et al . Malware clustering based on graph convolutional networks [J ] . Journal of Sichuan University (Natural Science Edition) , 2019 , 56 ( 4 ): 654 - 660 .

SHIN Y , MENEELY A , WILLIAMS L , et al . Evaluating complexity,code churn,and developer activity metrics as indicators of software vulnerabilities [J ] . IEEE Transactions on Software Engineering , 2011 , 37 ( 6 ): 772 - 787 .

NEIL L , MITTAL S , JOSHI A . Mining threat intelligence about open-source projects and libraries from code repository issues and bug reports [C ] // Proceedings of 2018 IEEE International Conference on Intelligence and Security Informatics . 2018 : 7 - 12 .

曹琰 , 刘龙 , 王禹 , 等 . 基于函数语义分析的软件补丁比对技术 [J ] . 网络与信息安全学报 , 2019 , 5 ( 5 ): 56 - 63 .

CAO Y , LIU L , WANG Y , et al . Software patch comparison technology through semantic analysis on function [J ] . Chinese Journal of Network and Information Security , 2019 , 5 ( 5 ): 56 - 63 .

PONTA S E , PLATE H , SABETTA A , et al . A manually-curated dataset of fixes to vulnerabilities of open-source software [C ] // Proceedings of 2019 IEEE/ACM 16th International Conference on Mining Software Repositories (MSR) . 2019 : 383 - 387 .

RAMOS J . Using TF-IDF to determine word relevance in document queries [J ] . Proceedings of the First Instructional Conference on Machine Learning , 2003 : 29 - 48 .

RISTAD E S , YIANILOS P N . Learning string-edit distance [J ] . IEEE Transactions on Pattern Analysis and Machine Intelligence , 1998 , 20 ( 5 ): 522 - 532 .

吕维梅 , 刘坚 . C/C++程序安全漏洞的分类与分析 [J ] . 计算机工程与应用 , 2005 , 41 ( 5 ): 123 - 125 , 228 .

LYU W M , LIU J . The classification and analysis on safety holes of C/C++ programs [J ] . Computer Engineering and Applications , 2005 , 41 ( 5 ): 123 - 125 , 228 .

BREIMAN L . Random forests [J ] . Machine Learning , 2001 , 45 ( 1 ): 5 - 32 .

Views

492

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Anomaly detection in DNS: an empirical study

Research progress on detection of software vulnerabilities based on code similarity

method for machine learning backdoor attacks based on defense method based on diffusion models

Personal data privacy protection method based onvertical partitioning

Malicious user detection in Momo application based on spatio-temporal behavior and static attribute analysis

Related Author

ZUO Peng

CHEN Yong

KONG Kaichuan

HE Ming

HOU Ronghao

LI Qinghao

LIU Chunling

TANG Yonghe

Related Institution

China Internet Network Information Center

School of Cyber Science and Engineering, Jinan University

Information Engineering University

School of Medical Information, Wannan Medical College

School of Physics and Electronic Information, Anhui Normal University

⁰