基于程序过程间语义优化的深度学习漏洞检测方法

李妍; 羌卫中; 李珍; 邹德清; 金海

doi:10.11959/j.issn.2096-109x.2023085

您当前的位置：

首页 >

文章列表页 >

基于程序过程间语义优化的深度学习漏洞检测方法

学术论文 | 更新时间：2024-06-03

- 基于程序过程间语义优化的深度学习漏洞检测方法
- Deep learning vulnerability detection method based on optimized inter-procedural semantics of programs
- 网络与信息安全学报 2023年9卷第6期页码：86-101
- 作者机构：
  
  1. 大数据技术与系统国家地方联合工程研究中心服务计算技术与系统教育部重点实验室，湖北武汉 430074
  2. 分布式系统安全湖北省重点实验室，湖北武汉 430074
  3. 华中科技大学网络空间安全学院，湖北武汉 430074
  4. 华中科技大学计算机科学与技术学院，湖北武汉 430074
- 作者简介：
  
  [ "李妍（1998- ），女，陕西渭南人，华中科技大学硕士生，主要研究方向为深度学习和漏洞检测" ]
  [ "羌卫中（1977- ），男，江苏南通人，华中科技大学教授、博士生导师，主要研究方向为机密计算、云计算安全、软件安全" ]
  [ "李珍（1981- ），女，河北保定人，博士，华中科技大学副教授，主要研究方向为软件安全和人工智能安全" ]
  [ "邹德清（1975- ），男，湖南湘潭人，博士，华中科技大学教授、博士生导师，主要研究方向为云计算安全、网络攻防与漏洞检测、软件安全、隐私保护" ]
  [ "金海（1966- ），男，上海人，博士，华中科技大学教授、博士生导师，主要研究方向为计算机体系结构、虚拟化技术、集群计算和云计算、存储与安全" ]
- 基金信息：
  
  国家自然科学基金;The National Natural Science Foundation of China(62272187);国家自然科学基金;The National Nature Science Foundation of China(U1936211)
- DOI：10.11959/j.issn.2096-109x.2023085
  中图分类号： TP311
- 网络首发：2023-12，
  
  纸质出版：2023-12-25
- 稿件说明：
移动端阅览
李妍, 羌卫中, 李珍, 等. 基于程序过程间语义优化的深度学习漏洞检测方法[J]. 网络与信息安全学报, 2023,9(6):86-101.

Yan LI, Weizhong QIANG, Zhen LI, et al. Deep learning vulnerability detection method based on optimized inter-procedural semantics of programs[J]. Chinese Journal of Network and Information Security, 2023, 9(6): 86-101.
李妍, 羌卫中, 李珍, 等. 基于程序过程间语义优化的深度学习漏洞检测方法[J]. 网络与信息安全学报, 2023,9(6):86-101. DOI： 10.11959/j.issn.2096-109x.2023085.

Yan LI, Weizhong QIANG, Zhen LI, et al. Deep learning vulnerability detection method based on optimized inter-procedural semantics of programs[J]. Chinese Journal of Network and Information Security, 2023, 9(6): 86-101. DOI： 10.11959/j.issn.2096-109x.2023085.

摘要

近年来，软件漏洞引发的安全事件层出不穷，及早发现并修补漏洞能够有效降低损失。传统的基于规则的漏洞检测方法依赖于专家定义规则，存在较高的漏报率，基于深度学习的方法能够自动学习漏洞程序的潜在特征，然而随着软件复杂程度的提升，该类方法在面对真实软件时存在精度下降的问题。一方面，现有方法执行漏洞检测时大多在函数级工作，无法处理跨函数的漏洞样例；另一方面，BGRU和BLSTM等模型在输入序列过长时性能下降，不善于捕捉程序语句间的长期依赖关系。针对上述问题，优化了现有的程序切片方法，结合过程内和过程间切片对跨函数的漏洞进行全面的上下文分析以捕获漏洞触发的完整因果关系；应用了包含多头注意力机制的 Transformer 神经网络模型执行漏洞检测任务，共同关注来自不同表示子空间的信息来提取节点的深层特征，相较于循环神经网络解决了信息衰减的问题，能够更有效地学习源程序的语法和语义信息。实验结果表明，该方法在真实软件数据集上的 F1 分数达到了 73.4%，相较于对比方法提升了13.6%～40.8%，并成功检测出多个开源软件漏洞，证明了其有效性与实用性。

Abstract

In recent years

software vulnerabilities have been causing a multitude of security incidents

and the early discovery and patching of vulnerabilities can effectively reduce losses.Traditional rule-based vulnerability detection methods

relying upon rules defined by experts

suffer from a high false negative rate.Deep learning-based methods have the capability to automatically learn potential features of vulnerable programs.However

as software complexity increases

the precision of these methods decreases.On one hand

current methods mostly operate at the function level

thus unable to handle inter-procedural vulnerability samples.On the other hand

models such as BGRU and BLSTM exhibit performance degradation when confronted with long input sequences

and are not adept at capturing long-term dependencies in program statements.To address the aforementioned issues

the existing program slicing method has been optimized

enabling a comprehensive contextual analysis of vulnerabilities triggered across functions through the combination of intra-procedural and inter-procedural slicing.This facilitated the capture of the complete causal relationship of vulnerability triggers.Furthermore

a vulnerability detection task was conducted using a Transformer neural network architecture equipped with a multi-head attention mechanism.This architecture collectively focused on information from different representation subspaces

allowing for the extraction of deep features from nodes.Unlike recurrent neural networks

this approach resolved the issue of information decay and effectively learned the syntax and semantic information of the source program.Experimental results demonstrate that this method achieves an F1 score of 73.4% on a real software dataset.Compared to the comparative methods

it shows an improvement of 13.6% to 40.8%.Furthermore

it successfully detects several vulnerabilities in open-source software

confirming its effectiveness and applicability.

关键词

Keywords

references

CVE [EB ] .

SKYBOX SECURITY [EB ] .

WU T M , WEN S , XIANG Y , et al . Twitter spam detection:survey of new approaches and comparative study [J ] . Computers ＆ Security , 2018 , 76 ( 7 ): 265 - 284 .

LECUN Y , BENGIO Y , HINTON G . Deep learning [J ] . Nature , 2015 , 521 ( 7553 ): 436 - 444 .

LI Z , ZOU D Q , XU S H , et al . VulDeePecker:a deep learning-based system for vulnerability detection [C ] // The Network and Distributed System Security Symposium (NDSS) . 2018 : 18 - 21 .

CHAKRABORTY S , KRISHNA R , DING Y , et al . Deep learning based vulnerability detection:are we there yet [J ] . IEEE Transactions on Software Engineering (TSE) , 2021 , 48 ( 9 ): 3280 - 3296 .

DAM H K , TRAN T , PHAM T , et al . Automatic feature learning for predicting vulnerable software components [J ] . IEEE Transactions on Software Engineering (TSE) , 2018 , 47 ( 1 ): 67 - 85 .

LI Z , ZOU D Q , XU S H , et al . SySeVR:a framework for using deep learning to detect software vulnerabilities [J ] . IEEE Transactions on Dependable and Secure Computing (TDSC) , 2021 , 19 ( 4 ): 2244 - 2258 .

XIAO Y , CHEN B H , YU C D , et al . MVP:detecting vulnerabilities using patch-enhanced vulnerability signatures [C ] // Proceedings of USENIX Security Symposium . 2020 .

LIN G J , WEN S , HAN Q L , et al . Software vulnerability detection using deep neural networks:a survey [J ] . Proceedings of the IEEE , 2020 , 108 ( 10 ): 1825 - 1848 .

LIN G J , ZHANG J , LUO W , et al . POSTER:vulnerability discovery with function representation learning from unlabeled projects [C ] // Proceedings of the Conference on Computer and Communications Security (CCS) . 2017 .

ZHOU Y Q , LIU S Q , SIOW J , et al . Devign:effective vulnerability identification by learning comprehensive program semantics via graph neural networks [C ] // Proceedings of Annual Conference on Neural Information Processing Systems (NeurIPS) . 2019 .

VASWANI A , SHAZEER N , PARMAR N , et al . Attention is all you need [C ] // Proceedings of Advances in Neural Information Processing Systems (NIPS) . 2017 .

GHAFFARIAN S M , SHAHRIARI H R . Software vulnerability analysis and discovery using machine-learning and data-mining techniques [J ] . ACM Computing Surveys (CSUR) , 2017 , 50 ( 4 ): 1 - 36 .

ACHARYA M . Mining API patterns as partial orders from source code:from usage scenarios to specifications [C ] // Proceedings of Joint Meeting of the European Software Engineering Conference ＆the ACM Sigsoft Symposium on the Foundations of Software Engineering . 2007 .

SCANDARIATO R , WALDEN J , HOVSEPYAN A , et al . Predicting vulnerable software components via text mining [J ] . IEEE Transactions on Software Engineering (TSE) , 2014 , 40 ( 10 ): 993 - 1006 .

YAMAGUCHI F , WRESSNEGGER C , GASCON H , et al . Chucky:exposing missing checks in source code for vulnerability discovery [C ] // Proceedings of the Conference on Computer ＆ Communications Security (CCS) . 2013 .

WHITE M , VENDOME C , LINARES-VASQUEZ M , et al . Toward deep learning software repositories [C ] // Proceedings of IEEE/ACM Working Conference on Mining Software Repositories . 2015 .

WANG S , LIU T Y , TAN L . Automatically learning semantic features for defect prediction [C ] // Proceedings of IEEE/ACM 38th International Conference on Software Engineering (ICSE) . 2016 .

YAMAGUCHI F , GOLDE N , ARP D , et al . Modeling and discovering vulnerabilities with code property graphs [C ] // IEEE Symposium on Security and Privacy (S＆P) . 2014 .

SHAR L K , BRIAND L , TAN H . Web application vulnerability prediction using hybrid program analysis and machine learning [J ] . IEEE Transactions on Dependable and Secure Computing (TDSC) , 2015 , 12 ( 6 ): 688 - 707 .

LIN G J , ZHANG J , LUO W , et al . Cross-project transfer representation learning for vulnerable function discovery [J ] . IEEE Transactions on Industrial Informatics , 2018 , 14 ( 7 ): 3289 - 3297 .

LIN G J , XIAO W , ZHANG J , et al . Deep Learning-Based Vulnerable Function Detection:A Benchmark [C ] // Proceedings of International Conference on Information and Communications Security (ICICS) . 2019 .

李韵 , 黄辰林 , 王中锋 , 等 . 基于机器学习的软件漏洞挖掘方法综述 [J ] . 软件学报 , 2020 , 31 ( 7 ): 2040 - 2061 .

LI Y , HUANG C L , WANG Z F , et al . Survey of software vulnerability mining methods based on machine learning [J ] . Journal of Software . 2020 , 31 ( 7 ): 2040 - 2061 .

WANG H T , YE G X , TANG Z Y , et al . Combining graph-based learning with automated data collection for code vulnerability detection [J ] . IEEE Transactions on Dependable and Secure Computing (TIFS) , 2020 , 16 : 1943 - 1958 .

LI Y , WANG S H , NGUYEN T N . Vulnerability detection with fine-grained interpretations [C ] // Proceedings of ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) . 2021 .

YING R , BOURGEOIS D , YOU J X , et al . GNNExplainer:generating explanations for graph neural networks [C ] // Proceedings of International Conference on Neural Information Processing Systems(NIPS) . 2019 .

SONNEKALB T . Machine-learning supported vulnerability detection in source code [C ] // Proceedings of ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) . 2019 .

RUSSELL R L , KIM L , LEI H H , et al . Automated vulnerability detection in source code using deep representation learning [C ] // 2018 IEEE 17th International Conference on Machine Learning and Applications (ICMLA) . 2018 .

CHENG X , WANG H Y , HUA J Y , et al . DeepWukong:statically detecting software vulnerabilities using deep graph neural network [J ] . ACM Transactions on Software Engineering and Methodology (TOSEM 2021) , 2021 , 30 ( 3 ): 1 - 33 .

段旭 , 吴敬征 , 罗天悦 , 等 . 基于代码属性图及注意力双向LSTM的漏洞挖掘方法 [J ] . 软件学报 , 2020 , 31 ( 11 ): 3404 - 3420 .

DUAN X , WU J Z , LUO T Y , et al . Vulnerability mining method based on code property graph and attention BiLSTM [J ] . Journal of Software , 2020 , 31 ( 11 ): 3404 - 3420 .

陈肇炫 , 邹德清 , 李珍 , 等 . 基于抽象语法树的智能化漏洞检测系统 [J ] . 信息安全学报 , 2020 , 5 ( 4 ): 1 - 13 .

CHEN Z X , ZOU D Q , LI Z , et al . Intelligent vulnerability detection system based on abstract syntax tree [J ] . Journal of Cyber Security . 2020 , 5 ( 4 ): 1 - 13 .

胡雨涛 , 王溯远 , 吴月明 , 等 . 基于图神经网络的切片级漏洞检测及解释方法 [J ] . 软件学报 , 2023 , 34 ( 6 ): 65 - 82 .

HU Y T , WANG S Y , WU Y M , et al . A Slice-level vulnerability detection and interpretation method based on graph neural network [J ] . Journal of Software , 2023 , 34 ( 6 ): 65 - 82 .

Joern [EB ]

Neo4j graph platform [EB ]

MIKOLOV T , CHEN K , CORRADO G , et al . Efficient estimation of word representations in vector space [J ] . Computer Science , 2013 ( 1 ).

Checkmarx [EB ] .

Flawfinder [EB ] .

浏览量

215

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于双分支网络的图像修复取证方法

基于图结构源代码切片的智能化漏洞检测系统

融合色彩空间特征与频域特征的多源伪造图像检测方法

基于双路特征提取和自适应融合的钓鱼网站检测

DNS异常检测：大规模实验分析