面向项目版本差异性的漏洞识别技术研究

黄诚; 孙明旭; 段仁语; 吴苏晟; 陈斌

doi:10.11959/j.issn.2096-109x.2021094

您当前的位置：

首页 >

文章列表页 >

面向项目版本差异性的漏洞识别技术研究

专栏：安全感知与检测方法 | 更新时间：2024-06-03

- 面向项目版本差异性的漏洞识别技术研究
- Vulnerability identification technology research based on project version difference
- 网络与信息安全学报 2022年8卷第1期页码：52-62
- 作者机构：
  
  1. 四川大学网络空间安全学院，四川成都 610065
  2. 广西密码学与信息安全重点实验室，广西桂林541000
- 作者简介：
  
  [ "黄诚（1987− ），男，重庆人，四川大学副教授，主要研究方向为网络空间安全、攻击检测、威胁溯源、数据挖掘、社交网络、机器学习和自然语言处理" ]
  [ "孙明旭（2000− ），男，黑龙江绥化人，主要研究方向为数据挖掘、自然语言处理和漏洞情报分析" ]
  [ "段仁语（1998− ），男，重庆人，主要研究方向为漏洞情报挖掘、计算机视觉和人工智能" ]
  [ "吴苏晟（1999− ），男，浙江杭州人，主要研究方向为漏洞挖掘和开源代码漏洞库的分析与构建" ]
  [ "陈斌（1999− ），男，江西南昌人，主要研究方向为漏洞挖掘与自然语言处理" ]
- 基金信息：
  
  国家自然科学基金;The National Natural Science Foundation of China(61902265);四川省科技厅重点研发项目;Sichuan Science and Technology Program(2020YFG0047);广西密码学与信息安全重点实验室研究课题;Guangxi Key Laboratory of Cryptography and Information Security(GCIS201921)
- DOI：10.11959/j.issn.2096-109x.2021094
  中图分类号： TP393
- 网络首发：2022-02，
  
  纸质出版：2022-02-15
- 稿件说明：
移动端阅览
黄诚, 孙明旭, 段仁语, 等. 面向项目版本差异性的漏洞识别技术研究[J]. 网络与信息安全学报, 2022,8(1):52-62.

Cheng HUANG, Mingxu SUN, Renyu DUAN, et al. Vulnerability identification technology research based on project version difference[J]. Chinese Journal of Network and Information Security, 2022, 8(1): 52-62.
黄诚, 孙明旭, 段仁语, 等. 面向项目版本差异性的漏洞识别技术研究[J]. 网络与信息安全学报, 2022,8(1):52-62. DOI： 10.11959/j.issn.2096-109x.2021094.

Cheng HUANG, Mingxu SUN, Renyu DUAN, et al. Vulnerability identification technology research based on project version difference[J]. Chinese Journal of Network and Information Security, 2022, 8(1): 52-62. DOI： 10.11959/j.issn.2096-109x.2021094.

摘要

开源代码托管平台为软件开发行业带来了活力和机遇，但存在诸多安全隐患。开源代码的不规范性、项目依赖库的复杂性、漏洞披露平台收集漏洞的被动性等问题都影响着开源项目及引入开源组件的闭源项目的安全，大部分漏洞修复行为无法及时被察觉和识别，进而将各类项目的安全风险直接暴露给攻击者。为了全面且及时地发现开源项目中的漏洞修复行为，设计并实现了基于项目版本差异性的漏洞识别系统—VpatchFinder。系统自动获取开源项目中的更新代码及内容数据，对更新前后代码和文本描述信息进行提取分析。提出了基于安全行为与代码特征的差异性特征，提取了包括项目注释信息特征组、页面统计特征组、代码统计特征组以及漏洞类型特征组的共 40 个特征构建特征集，采用随机森林算法来训练可识别漏洞的分类器。通过真实漏洞数据进行测试，VpatchFinder 的精确率为 84.35%，准确率为 85.46%，召回率为85.09%，优于其他常见的机器学习算法模型。进一步通过整理的历年部分开源软件 CVE 漏洞数据进行实验，其结果表明 68.07%的软件漏洞能够提前被 VpatchFinder 发现。该研究结果可以为软件安全架构设计、开发及成分分析等领域提供有效技术支撑。

Abstract

The open source code hosting platform has brought power and opportunities to software development

but there are also many security risks.The open source code has poor quality

the dependency libraries of projects are complex and vulnerability collection platforms are inadequate in collecting vulnerabilities.All these problems affect the security of open source projects and complex software with open source complements and most security patches can't be discovered and applied in time.Thus

the hackers could be easily found such vulnerable software.To discover the vulnerability in the open source community fully and timely

a vulnerability identification system based on project version difference was proposed.The update contents of projects in the open source community were collected automatically

then features were defined as security behaviors and code differences from the code and log in patches

40 features including comment information feature group

page statistics feature group

code statistics feature group and vulnerability type feature group were proposed to build feature set.And random forest model was built to learn classifiers for vulnerability identification.The results show that VpatchFinder achieves a precision rate of 0.844

an accuracy rate of 0.855 and a recall rate of 0.851.Besides

68.07% of community vulnerabilities can be early discovered by VpatchFinder in real open source CVE vulnerabilities.This research result can improve the current issue in software security architecture design and development.

关键词

Keywords

references

ALFADEL M , COSTA D E , SHIHAB E , et al . On the use of dependabot security pull requests [C ] // Proceedings of 2021 IEEE/ACM 18th International Conference on Mining Software Repositories (MSR) . 2021 : 254 - 265 .

PASHCHENKO I , PLATE H , PONTA S E , et al . Vulnerable open source dependencies:counting those that matter [C ] // Proceedings of the 12th ACM/IEEE International Symposium on Empirical Software Engineering and Measurement . 2018 : 1 - 10 .

SABETTA A , BEZZI M . A practical approach to the automatic classification of security-relevant commits [C ] // Proceedings of 2018 IEEE International Conference on Software Maintenance and Evolution . 2018 : 579 - 582 .

KAMIYA T , KUSUMOTO S , INOUE K . CCFinder:a multilinguistic token-based code clone detection system for large scale source code [J ] . IEEE Transactions on Software Engineering , 2002 , 28 ( 7 ): 654 - 670 .

LI Z , LU S , MYAGMAR S , et al . CP-Miner:finding copy-paste and related bugs in large-scale software code [J ] . IEEE Transactions on Software Engineering , 2006 , 32 ( 3 ): 176 - 192 .

王雅文 , 姚欣洪 , 宫云战 , 等 . 一种基于代码静态分析的缓冲区溢出检测算法 [J ] . 计算机研究与发展 , 2012 , 49 ( 4 ): 839 - 845 .

WANG Y W , YAO X H , GONG Y Z , et al . A method of buffer overflow detection based on static code analysis [J ] . Journal of Computer Research and Development , 2012 , 49 ( 4 ): 839 - 845 .

王蕾 , 李丰 , 李炼 , 等 . 污点分析技术的原理和实践应用 [J ] . 软件学报 , 2017 , 28 ( 4 ): 860 - 882 .

WANG L , LI F , LI L , et al . Principle and practice of taint analysis [J ] . Journal of Software , 2017 , 28 ( 4 ): 860 - 882 .

YAMAGUCHI F , LOTTMANN M , RIECK K . Generalized vulnerability extrapolation using abstract syntax trees [C ] // Proceedings of the 28th Annual Computer Security Applications Conference . 2012 : 359 - 368 .

LI J Y , ERNST M D . CBCD:cloned buggy code detector [C ] // Proceedings of 2012 34th International Conference on Software Engineering (ICSE) . 2012 : 310 - 320 .

LI Z , ZOU D Q , XU S H , et al . VulDeePecker:a deep learning-based system for vulnerability detection [C ] // Proceedings 2018 Network and Distributed System Security Symposium . 2018 .

TIAN Y , LAWALL J , LO D . Identifying Linux bug fixing patches [C ] // Proceedings of 2012 34th International Conference on Software Engineering (ICSE) . 2012 : 386 - 396 .

PERL H , DECHAND S , SMITH M , et al . VCCFinder:finding potential vulnerabilities in open-source projects to assist code audits [C ] // Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security . 2015 : 426 - 437 .

ZAMAN S , ADAMS B , HASSAN A E . Security versus performance bugs:a case study on Firefox [C ] // Proceedings of the 8th Working Conference on Mining Software Repositories . 2011 : 93 - 102 .

LI F , PAXSON V . A large-scale empirical study of security patches [C ] // Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security . 2017 : 2201 - 2215 .

WANG X D , SUN K , BATCHELLER A , et al . An empirical study of secret security patch in open source software [M ] // Adaptive Autonomous Secure Cyber Systems . 2020 : 269 - 289 .

NEUHAUS S , ZIMMERMANN T , HOLLER C , et al . Predicting vulnerable software components [C ] // Proceedings of the 14th ACM Conference on Computer and Communications Security . 2007 : 529 - 540 .

郑荣锋 , 方勇 , 刘亮 . 基于动态行为指纹的恶意代码同源性分析 [J ] . 四川大学学报(自然科学版) , 2016 , 53 ( 4 ): 793 - 798 .

ZHENG R F , FANG Y , LIU L . Homology analysis of malicious code based on dynamic-behavior fingerprint [J ] . Journal of Sichuan University (Natural Science Edition) , 2016 , 53 ( 4 ): 793 - 798 .

KONG D G , ZHENG Q , CHEN C , et al . ISA:a source code static vulnerability detection system based on data fusion [C ] // Proceedings of the 2nd International ICST Conference on Scalable Information Systems . 2007 :55.

SONNEKALB T , . Machine-learning supported vulnerability detection in source code [C ] // Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering . 2019 : 1180 - 1183 .

李元诚 , 崔亚奇 , 吕俊峰 , 等 . 开源软件漏洞检测的混合深度学习方法 [J ] . 计算机工程与应用 , 2019 , 55 ( 11 ): 52 - 59 .

LI Y C , CUI Y Q , LYU J F , et al . Combined deep learning method for open source software vulnerability detection [J ] . Computer Engineering and Applications , 2019 , 55 ( 11 ): 52 - 59 .

JIANG L X , MISHERGHI G , SU Z D , et al . DECKARD:scalable and accurate tree-based detection of code clones [C ] // Proceedings of 29th International Conference on Software Engineering (ICSE'07) . 2007 : 96 - 105 .

ALON U , ZILBERSTEIN M , LEVY O , et al . code2vec:learning distributed representations of code [J ] . Proceedings of the ACM on Programming Languages , 2019 ,3:40.

LIU C , CHEN C , HAN J W , et al . GPLAG:detection of software plagiarism by program dependence graph analysis [C ] // Proceedings of the 12th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining . 2006 : 872 - 881 .

PHAM N H , NGUYEN T T , NGUYEN H A , et al . Detection of recurring software vulnerabilities [C ] // ASE '10:Proceedings of the IEEE/ACM International Conference on Automated Software Engineering . 2010 : 447 - 456 .

刘凯 , 方勇 , 张磊 , 等 . 基于图卷积网络的恶意代码聚类 [J ] . 四川大学学报(自然科学版) , 2019 , 56 ( 4 ): 654 - 660 .

LIU K , FANG Y , ZHANG L , et al . Malware clustering based on graph convolutional networks [J ] . Journal of Sichuan University (Natural Science Edition) , 2019 , 56 ( 4 ): 654 - 660 .

SHIN Y , MENEELY A , WILLIAMS L , et al . Evaluating complexity,code churn,and developer activity metrics as indicators of software vulnerabilities [J ] . IEEE Transactions on Software Engineering , 2011 , 37 ( 6 ): 772 - 787 .

NEIL L , MITTAL S , JOSHI A . Mining threat intelligence about open-source projects and libraries from code repository issues and bug reports [C ] // Proceedings of 2018 IEEE International Conference on Intelligence and Security Informatics . 2018 : 7 - 12 .

曹琰 , 刘龙 , 王禹 , 等 . 基于函数语义分析的软件补丁比对技术 [J ] . 网络与信息安全学报 , 2019 , 5 ( 5 ): 56 - 63 .

CAO Y , LIU L , WANG Y , et al . Software patch comparison technology through semantic analysis on function [J ] . Chinese Journal of Network and Information Security , 2019 , 5 ( 5 ): 56 - 63 .

PONTA S E , PLATE H , SABETTA A , et al . A manually-curated dataset of fixes to vulnerabilities of open-source software [C ] // Proceedings of 2019 IEEE/ACM 16th International Conference on Mining Software Repositories (MSR) . 2019 : 383 - 387 .

RAMOS J . Using TF-IDF to determine word relevance in document queries [J ] . Proceedings of the First Instructional Conference on Machine Learning , 2003 : 29 - 48 .

RISTAD E S , YIANILOS P N . Learning string-edit distance [J ] . IEEE Transactions on Pattern Analysis and Machine Intelligence , 1998 , 20 ( 5 ): 522 - 532 .

吕维梅 , 刘坚 . C/C++程序安全漏洞的分类与分析 [J ] . 计算机工程与应用 , 2005 , 41 ( 5 ): 123 - 125 , 228 .

LYU W M , LIU J . The classification and analysis on safety holes of C/C++ programs [J ] . Computer Engineering and Applications , 2005 , 41 ( 5 ): 123 - 125 , 228 .

BREIMAN L . Random forests [J ] . Machine Learning , 2001 , 45 ( 1 ): 5 - 32 .

浏览量

492

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

DNS异常检测：大规模实验分析

基于代码相似性的软件漏洞检测研究进展

基于扩散模型的机器学习后门攻击防御方法

基于垂直分割的个人数据隐私保护方法

基于时空行为与静态属性分析的陌陌应用恶意用户检测方法