基于图神经网络的代码漏洞检测方法

陈皓; 易平

doi:10.11959/j.issn.2096-109x.2021039

您当前的位置：

首页 >

文章列表页 >

基于图神经网络的代码漏洞检测方法

专栏Ⅰ：神经网络技术应用 | 更新时间：2024-06-03

- 基于图神经网络的代码漏洞检测方法
- Code vulnerability detection method based on graph neural network
- 网络与信息安全学报 2021年7卷第3期页码：37-45
- 作者机构：
- 作者简介：
  
  [ "陈皓（1995- ），男，山东潍坊人，上海交通大学硕士生，主要研究方向为深度学习与漏洞检测" ]
  [ "易平（1969- ），男，河南洛阳人，博士，上海交通大学副教授，主要研究方向为人工智能安全" ]
- 基金信息：
  
  国家重点研发计划;The National Key R＆D Program of China(2019YFB1405000);国家重点研发计划基金资助项目;The Natural Science Foundation of Jiangsu Province(2017YFB0802900)
- DOI：10.11959/j.issn.2096-109x.2021039
  中图分类号： TP309
- 网络首发：2021-06，
  
  纸质出版：2021-06-15
- 稿件说明：
移动端阅览
陈皓, 易平. 基于图神经网络的代码漏洞检测方法[J]. 网络与信息安全学报, 2021,7(3):37-45.

Hao CHEN, Ping YI. Code vulnerability detection method based on graph neural network[J]. Chinese Journal of Network and Information Security, 2021, 7(3): 37-45.
陈皓, 易平. 基于图神经网络的代码漏洞检测方法[J]. 网络与信息安全学报, 2021,7(3):37-45. DOI： 10.11959/j.issn.2096-109x.2021039.

Hao CHEN, Ping YI. Code vulnerability detection method based on graph neural network[J]. Chinese Journal of Network and Information Security, 2021, 7(3): 37-45. DOI： 10.11959/j.issn.2096-109x.2021039.

摘要

使用神经网络进行漏洞检测的方案大多基于传统自然语言处理的思路，将源代码当作序列样本处理，忽视了代码中所具有的结构性特征，从而遗漏了可能存在的漏洞。提出了一种基于图神经网络的代码漏洞检测方法，通过中间语言的控制流图特征，实现了函数级别的智能化代码漏洞检测。首先，将源代码编译为中间表示，进而提取其包含结构信息的控制流图，同时使用词向量嵌入算法初始化基本块向量提取代码语义信息；然后，完成拼接生成图结构样本数据，使用多层图神经网络对图结构数据特征进行模型训练和测试。采用开源漏洞样本数据集生成测试数据对所提方法进行了评估，结果显示该方法有效提高了漏洞检测能力。

Abstract

The schemes of using neural networks for vulnerability detection are mostly based on traditional natural language processing ideas

processing the code as array samples and ignoring the structural features in the code

which may omit possible vulnerabilities.A code vulnerability detection method based on graph neural network was proposed

which realized function-level code vulnerability detection through the control flow graph feature of the intermediate language.Firstly

the source code was compiled into an intermediate representation

and then the control flow graph containing structural information was extracted.At the same time

the word vector embedding algorithm was used to initialize the vector of basic block to extract the code semantic information.Then both of above were spliced to generate the graph structure sample data.The multilayer graph neural network model was trained and tested on graph structure data features.The open source vulnerability sample data set was used to generate test data to evaluate the method proposed.The results show that the method effectively improves the vulnerability detection ability.

关键词

Keywords

references

《国家网络空间安全战略》(全文) [J ] . 中国信息安全 , 2017 ( 1 ): 26 - 31 .

“National Cyberspace Security Strategy” (full-text) [J ] . China Information Security , 2017 ( 1 ): 26 - 31 .

WU Z , PAN S , CHEN F , et al . A comprehensive survey on graph neural networks [J ] . arXiv:1901.00596 , 2019 .

PHAM N H , NGUYEN T T , NGUYEN H A , et al . Detection of recurring software vulnerabilities [C ] // 25th IEEE/ACM International Conference on Automated Software Engineering . 2010 .

YAMAGUCHI F , GOLDE N , ARP D , et al . Modeling and discovering vulnerabilities with code property graphs [C ] // IEEE Symposium on Security and Privacy . 2014 .

LIN G , ZHANG J , LUO W , et al . POSTER:vulnerability discovery with function representation learning from unlabeled projects [C ] // ACM Sigsac Conference . 2017 .

RUSSELL R , KIM L , HAMILTON L , et al . Automated vulnerability detection in source code using deep representation learning [C ] // 2018 17th IEEE International Conference on Machine Learning and Applications (ICMLA) . 2018 : 757 - 762 .

XU X , LIU C , FENG Q , et al . Neural network-based graph embedding for cross-platform binary code similarity detection [C ] // Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security-(CCS′17) . 2017 : 363 - 376 .

LI Y , GU C , DULLIEN T , et al . Graph matching networks for learning the similarity of graph structured objects [C ] // Thirty-sixth International Conference on Machine Learning(ICML 2019) . 2019 .

YU Z , CAO R , TANG Q , et al . Order matters:semantic-aware neural networks for binary code similarity detection [C ] // The Thirty-Fourth AAAI Conference on Artificial Intelligence (AAAI-20) . 2020 .

DUAN Y , LI X , WANG J , et al . DeepBinDiff:learning program-wide code representations for binary diffing [C ] // Proceedings 2020 Network and Distributed System Security Symposium . 2020 .

李珍 , 邹德清 , 王泽丽 , 等 . 面向源代码的软件漏洞静态检测综述 [J ] . 网络与信息安全学报 , 2019 , 5 ( 1 ): 1 - 14 .

LI Z , ZOU D Q , WANG Z L , et al . Survey on static software vulnerability detection for source code [J ] . Chinese Journal of Network and Information Security , 2019 , 5 ( 1 ): 1 - 14 .

GORI M , GABRIELE M , FRANCO S . A new model for learning in graph domains [C ] // IEEE International Joint Conference on Neural Networks . 2005 .

SCARSELLI F , GORI M , TSOI A C , et al . The graph neural network model [J ] . IEEE Transactions on Neural Networks , 2009 , 20 ( 1 ): 61 - 80 .

GILMER J , SCHOENHOLZ S S , RILEY P F , et al . Neural message passing for Quantum chemistry [C ] // Proceedings of the 34th International Conference on Machine Learning-Volume 70 (ICML’17) . 2011 : 1263 - 1272 .

MIKOLOV T , CHEN K , CORRADO G , et al . Efficient estimation of word representations in vector space [J ] . arXiv preprint arXiv:1301.3781 , 2013 .

KIPF T N , WELLING M . Semi-supervised classification with graph convolutional networks [J ] . arXiv preprint arXiv:1609.02907 , 2016 .

NIST software assurance reference dataset project [EB ] .

Flawfinder [EB ] .

Rough-auditing-tool-for-security [EB ] .

浏览量

883

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于代码相似性的软件漏洞检测研究进展

基于图Transformer的门级硬件木马检测方法

基于数据增强的多视图对比学习图异常检测

基于多查询的社交网络关键节点挖掘算法

基于程序过程间语义优化的深度学习漏洞检测方法