基于代码相似性的软件漏洞检测研究进展

李晴浩; 刘春玲; 唐永鹤; 董卫宇

doi:10.11959/j.issn.2096-109x.2025065

您当前的位置：

首页 >

文章列表页 >

基于代码相似性的软件漏洞检测研究进展

综述 | 更新时间：2026-01-28

- 基于代码相似性的软件漏洞检测研究进展
- Research progress on detection of software vulnerabilities based on code similarity
- 网络与信息安全学报 2025年11卷第6期页码：36-62
- 作者机构：
  
  信息工程大学，河南郑州 450001
- 作者简介：
  
  [ "李晴浩（1998- ），男，湖南邵阳人，信息工程大学博士生，主要研究方向为信息安全、代码相似性检测、漏洞检测。" ]
  [ "刘春玲（1981- ），女，河南滑县人，信息工程大学讲师，主要研究方向为代码相似性检测、漏洞检测。" ]
  [ "唐永鹤（1983- ），男，河南确山人，信息工程大学副教授，主要研究方向为计算机安全、恶意代码检测。" ]
  [ "董卫宇（1976- ），男，辽宁沈阳人，信息工程大学教授，主要研究方向为计算机架构、系统虚拟化、计算机安全、漏洞检测。" ]
- 基金信息：
  
  河南省重点研发专项计划(221111210300)
- DOI：10.11959/j.issn.2096-109x.2025065
  中图分类号： TP393
- 收稿：2025-03-17，
  
  修回：2025-05-17，
  
  纸质出版：2025-12-25
- 稿件说明：
移动端阅览
李晴浩, 刘春玲, 唐永鹤, 等. 基于代码相似性的软件漏洞检测研究进展[J]. 网络与信息安全学报, 2025, 11(6): 36-62.

LI Qinghao, LIU Chunling, TANG Yonghe, et al. Research progress on detection of software vulnerabilities based on code similarity[J]. Chinese Journal of Network and Information Security, 2025, 11(6): 36-62.
李晴浩, 刘春玲, 唐永鹤, 等. 基于代码相似性的软件漏洞检测研究进展[J]. 网络与信息安全学报, 2025, 11(6): 36-62. DOI： 10.11959/j.issn.2096-109x.2025065.

LI Qinghao, LIU Chunling, TANG Yonghe, et al. Research progress on detection of software vulnerabilities based on code similarity[J]. Chinese Journal of Network and Information Security, 2025, 11(6): 36-62. DOI： 10.11959/j.issn.2096-109x.2025065.

摘要

软件漏洞是长期困扰网络与信息安全领域的一类关键威胁，而漏洞检测是缓解此类威胁的首要技术手段。基于代码相似性的漏洞检测具有可规模化、低成本的优势；特别是与图神经网络、循环神经网络等人工智能技术结合后，其准确性与适用性进一步提升，正成为该领域的研究热点。系统梳理了近7年来基于代码相似性的软件漏洞检测进展：从数据集角度，剖析了漏洞样本数据集的类别、粒度、规模及其平衡性；从代码预处理角度，总结了代码清理与标准化、反汇编与中间语言表示等两类方法；从代码表征角度，归纳了基于代码片段、哈希、树、图、指标及混合表征6种方案的检测机制、优缺点与适用场景，并在统一评测指标下对比其检测性能与开销；进一步提炼了所用机器学习技术的类别与特点。最后，总结了该研究面临的挑战，并展望了未来的研究方向。

Abstract

Software vulnerabilities have long been a key threat to the field of network and information security

and vulnerability detection is the primary technical means to mitigate such threats. Vulnerability detection based on code similarity offers the advantages of scalability and low cost

particularly when combined with artificial intelligence technologies such as graph neural networks and recurrent neural networks

further enhancing its accuracy and applicability

making it a research hotspot in this field. This paper systematically reviews the progress of software vulnerability detection based on code similarity in the past seven years: from the perspective of datasets

it analyzes the categories

granularity

scale

and balance of vulnerability sample datasets; from the perspective of code preprocessing

it summarizes two types of methods: code cleaning and standardization

and disassembly and intermediate language representation; from the perspective of code representation

it categorizes six schemes of detection mechanisms

advantages and disadvantages

and applicable scenarios based on code snippets

hashes

trees

graphs

metrics

and hybrid representations

and compares their detection performance and overhead under unified evaluation metrics. Furthermore

it distills the categories and characteristics of the machine learning techniques employed. Finally

it summarizes the challenges faced by this research and looks forward to future research directions.

关键词

Keywords

references

LIANG H L , PEI X X , JIA X D , et al . Fuzzing: state of the art [J ] . IEEE Transactions on Reliability , 2018 , 67 ( 3 ): 1199 - 1218 .

MANÈS V J M , HAN H , HAN C , et al . The art, science, and engineering of fuzzing: a survey [J ] . IEEE Transactions on Software Engineering , 2021 , 47 ( 11 ): 2312 - 2331 .

BALDONI R , COPPA E , D’ELIA D C , et al . A survey of symbolic execution techniques [J ] . ACM Computing Surveys , 2019 , 51 ( 3 ): 1 - 39 .

CADAR C , SEN K . Symbolic execution for software testing [J ] . Communications of the ACM , 2013 , 56 ( 2 ): 82 - 90 .

NEWSOME J , SONG D X . Dynamic taint analysis for automatic detection, analysis, and signaturegeneration of exploits on commodity software [C ] // NDSS . 2005 , 5 : 3 - 4 .

SCHWARTZ E J , AVGERINOS T , BRUMLEY D . All you ever wanted to know about dynamic taint analysis and forward symbolic execution (but might have been afraid to ask) [C ] // Proceedings of the 2010 IEEE Symposium on Security and Privacy . Piscataway : IEEE Press , 2010 : 317 - 331 .

LI Z , LU S , MYAGMAR S , et al . CP-Miner: finding copy-paste and related bugs in large-scale software code [J ] . IEEE Transactions on Software Engineering , 2006 , 32 ( 3 ): 176 - 192 .

WHALE G . Plague: plagiarism detection using program structure [M ] . School of Electrical Engineering and Computer Science, University of New South Wales , 1988 .

YU ZQ , ZHENG W X , WANG J Q , et al . CodeCMR: cross-modal retrieval for function-level binary source code matching [J ] . Advances in Neural Information Processing Systems , 2020 ， 33 ： 3872 - 3883 .

LOPES C V , MAJ P , MARTINS P , et al . DéjàVu: a map of code duplicates on GitHub [C ] // Proceedings of the ACM on Programming Languages , New York : ACM , 2017 , 1 : 1 - 28 .

EGHBALI A , PRADEL M . CrystalBLEU: precisely and efficiently measuring the similarity of code [C ] // Proceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering . New York : ACM , 2022 : 1 - 12 .

ZHANG X C , SUN W J , PANG J M , et al . Similarity metric method for binary basic blocks of cross-instruction set architecture [C ] // Proceedings 2020 Workshop on Binary Analysis Research . Internet Society , 2020 .

ISLAM M R , ZIBRAN M F , NAGPAL A . Security vulnerabilities in categories of clones and non-cloned code: an empirical study [C ] // Proceedings of the 2017 ACM/IEEE International Symposium on Empirical Software Engineering and Measurement (ESEM) . Piscataway : IEEE Press , 2017 : 20 - 29 .

Open source security and risk analysis report [EB ] . 2022 .

李珍 , 邹德清 , 王泽丽 , 等 . 面向源代码的软件漏洞静态检测综述 [J ] . 网络与信息安全学报 , 2019 , 5 ( 1 ): 1 - 14 .

LI Z , ZOU D Q , WANG Z L , et al . Survey on static software vulnerability detection for source code [J ] . Chinese Journal of Network and Information Security , 2019 , 5 ( 1 ): 1 - 14 .

李韵 , 黄辰林 , 王中锋 , 等 . 基于机器学习的软件漏洞挖掘方法综述 [J ] . 软件学报 , 2020 , 31 ( 7 ): 2040 - 2061 .

LI Y , HUANG C L , WANG Z F , et al . Survey of software vulnerability mining methods based on machine learning [J ] . Journal of Software , 2020 , 31 ( 7 ): 2040 - 2061 .

LIN G J , WEN S , HAN Q L , et al . Software vulnerability detection using deep neural networks: a survey [J ] . Proceedings of the IEEE , 2020 , 108 ( 10 ): 1825 - 1848 .

CHAKRABORTY S , KRISHNA R , DING Y , et al . Deep learning based vulnerability detection: Are we there yet [J ] . IEEE Transactions on Software Engineering , 2021 .

STEENHOEK B , RAHMAN M M , JILES R , et al . An empirical study of deep learning models for vulnerability detection [C ] // Proceedings of the 2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE) . Piscataway : IEEE Press , 2023 : 2237 - 2248 .

LIPP S , BANESCU S , PRETSCHNER A . An empirical study on the effectiveness of static C code analyzers for vulnerability detection [C ] // Proceedings of the 31st ACM Sigsoft International Symposium on Software Testing and Analysis . New York : ACM , 2022 : 544 - 555 .

于颖超 , 甘水滔 , 邱俊洋 , 等 . 二进制代码相似度分析及在嵌入式设备固件漏洞搜索中的应用 [J ] . 软件学报 , 2022 , 33 ( 11 ): 4137 - 4172 .

YU Y C , GAN S T , QIU J Y , et al . Binary code similarity analysis and its applications on embedded device firmware vulnerability search [J ] . Journal of Software , 2022 , 33 ( 11 ): 4137 - 4172 .

NONG Y , SHARMA R , HAMOU-LHADJ A , et al . Open science in software engineering: a study on deep learning-based vulnerability detection [J ] . IEEE Transactions on Software Engineering , 2023 , 49 ( 4 ): 1983 - 2005 .

邓枭 , 叶蔚 , 谢睿 , 等 . 基于深度学习的源代码缺陷检测研究综述 [J ] . 软件学报 , 2023 , 34 ( 2 ): 625 - 654 .

DENG X , YE W , XIE R , et al . Survey of source code bug detection based on deep learning [J ] . Journal of Software , 2023 , 34 ( 2 ): 625 - 654 .

SARD: Software assurance reference dataset [EB ] . 2023 .

NVD [EB ] . 2023 .

CVE [EB ] . 2023 .

GitHub [EB ] . 2023 .

JEON S , KIM H K . AutoVAS: an automated vulnerability analysis system with a deep learning approach [J ] . Computers & Security , 2021 , 106 : 102308 .

WEN X C , CHEN Y P , GAO C Y , et al . Vulnerability detection with graph simplification and enhanced graph representation learning [C ] // Proceedings of the 2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE) . Piscataway : IEEE Press , 2023 : 2275 - 2286 .

XIAO Y , CHEN B H , YU C D , et al . MVP: detecting vulnerabilities using patch-enhanced vulnerability signatures [C ] // 29th USENIX Security Symposium . 2020 : 1165 - 1182 .

WANG H T , YE G X , TANG Z Y , et al . Combining graph-based learning with automated data collection for code vulnerability detection [J ] . IEEE Transactions on Information Forensics and Security , 2020 , 16 : 1943 - 1958 .

ZHOU Y Q , LIU S Q , SIOW J , et al . Devign: effective vulnerability identification by learning comprehensive program semantics via graph neural networks [EB ] . 2019 .

FAN J H , LI Y , WANG S H , et al . A C/C++ code vulnerability dataset with code changes and CVE summaries [C ] // Proceedings of the 2020 IEEE/ACM 17th International Conference on Mining Software Repositories (MSR) . Piscataway : IEEE Press , 2020 : 508 - 512 .

CHAKRABORTY S , KRISHNA R , DING Y , et al . Deep learning based vulnerability detection: Are we there yet [J ] . IEEE Transactions on Software Engineering , 2021 .

WANG X D , WANG S , FENG P B , et al . PatchDB: a large-scale security patch dataset [C ] // Proceedings of the 2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) . Piscataway : IEEE Press , 2021 : 149 - 160 .

CHEN Y Z , DING Z J , ALOWAIN L , et al . DiverseVul: a new vulnerable source code dataset for deep learning based vulnerability detection [C ] // Proceedings of the 26th International Symposium on Research in Attacks, Intrusions and Defenses . New York : ACM , 2023 : 654 - 668 .

ZHOU X , VERMA R M . Vulnerability detection via multimodal learning: datasets and analysis [C ] // Proceedings of the 2022 ACM on Asia Conference on Computer and Communications Security . New York : ACM , 2022 : 1225 - 1227 .

BRUST C A , SONNEKALB T , GRUNER B . ROMEO: a binary vulnerability detection dataset for exploring Juliet through the lens of assembly language [J ] . Computers & Security , 2023 , 128 : 103165 .

TAO W X , SU X H , WAN J Y , et al . Vulnerability detection through cross-modal feature enhancement and fusion [J ] . Computers & Security , 2023 , 132 : 103341 .

WANG Y , JIA P , PENG X , et al . BinVulDet: Detecting vulnerability in binary program via decompiled pseudo code and BiLSTM-attention [J ] . Computers & Security , 2023 , 125 : 103023 .

陈小全 , 刘剑 , 夏翔宇 , 等 . 基于比较学习的漏洞检测方法 [J ] . 计算机研究与发展 , 2023 , 60 ( 9 ): 2152 - 2168 .

CHEN X Q , LIU J , XIA X Y , et al . A vulnerability detection approach based on comparative learning [J ] . Journal of Computer Research and Development , 2023 , 60 ( 9 ): 2152 - 2168 .

CHAWLA N V , BOWYER K W , HALL L O , et al . SMOTE: synthetic minority over-sampling technique [J ] . Journal of Artificial Intelligence Research , 2002 , 16 : 321 - 357 .

LI H , ZOU P , WANG X , et al . A new combination sampling method for imbalanced data [C ] // Proceedings of 2013 Chinese Intelligent Automation Conference . Berlin, Heidelberg : Springer , 2013 : 547 - 554 .

ZHAO T X , ZHANG X , WANG S H . GraphSMOTE: imbalanced node classification on graphs with graph neural networks [C ] // Proceedings of the 14th ACM International Conference on Web Search and Data Mining . New York : ACM , 2021 : 833 - 841 .

MIRSKY Y , MACON G , BROWN M , et al . VulChecker: graph-based vulnerability localization in source code [C ] // 31st USENIX Security Symposium , Security 2022 . 2023 .

JI Y D , CUI L , HUANG H H . Buggraph: Differentiating source-binary code similarity with graph triplet-loss network [C ] // Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security . 2021 : 702 - 715 .

LI Z , ZOU D Q , XU S H , et al . VulDeePecker: a deep learning-based system for vulnerability detection [C ] // Proceedings 2018 Network and Distributed System Security Symposium . Internet Society , 2018 .

WANG P C , SVAJLENKO J , WU Y Z , et al . CCAligner: a token based large-gap clone detector [C ] // Proceedings of the 2018 IEEE/ACM 40th International Conference on Software Engineering (ICSE) . Piscataway : IEEE Press , 2018 : 1066 - 1077 .

WOO S H , LEE D W , PARK S H , et al . V0Finder: discovering the correct origin of publicly reported software vulnerabilities [C ] // 30th USENIX Security Symposium . 2021 : 3041 - 3058 .

HANIF H , MAFFEIS S . VulBERTa: simplified source code pre-training for vulnerability detection [C ] // Proceedings of the 2022 International Joint Conference on Neural Networks (IJCNN) . Piscataway : IEEE Press , 2022 : 1 - 8 .

WOO S H , HONG H J , CHOI E J , et al . MOVERY: A precise approach for modified vulnerable code clone discovery from modified open-source software components [C ] // 31st USENIX Security Symposium . 2022 : 3037 - 3053 .

LI X , QU Y , YIN H . PalmTree: learning an assembly language model for instruction embedding [C ] // Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2021 : 3236 - 3251 .

YANG S G , CHENG L , ZENG Y C , et al . Asteria: deep learning-based AST-encoding for cross-platform binary code similarity detection [C ] // Proceedings of the 2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) . Piscataway : IEEE Press , 2021 : 224 - 236 .

YAN H , LUO S L , PAN L M , et al . HAN-BSVD: a hierarchical attention network for binary software vulnerability detection [J ] . Computers & Security , 2021 , 108 : 102286 .

WANG H , QU W J , KATZ G , et al . Jtrans: Jump-aware transformer for binary code similarity detection [C ] // Proceedings of the 31st ACM SIGSOFT International Symposium on Software Testing and Analysis . 2022 : 1 - 13 .

LUO Z H , WANG P F , WANG B S , et al . VulHawk: cross-architecture vulnerability detection with entropy-based binary code search [C ] // Proceedings 2023 Network and Distributed System Security Symposium . Internet Society , 2023 :

LI L T , DING S H H , TIAN Y , et al . VulANalyzeR: explainable binary vulnerability detection with multi-task learning and attentional graph convolution [J ] . ACM Transactions on Privacy and Security , 2023 , 26 ( 3 ): 1 - 25 .

IDA [EB ] . 2023 .

LE T , NGUYEN T , LE T , et al . Maximal divergence sequential autoencoder for binary software vulnerability detection [C ] // International Conference on Learning Representations . 2018 .

Capstone [EB ] . 2023 .

GAO J , YANG X , FU Y , et al . VulSeeker: a semantic learning based vulnerability seeker for cross-platform binary [C ] // Proceedings of the 2018 33rd IEEE/ACM International Conference on Automated Software Engineering (ASE) . Piscataway : IEEE Press , 2018 : 896 - 899 .

XUE Y X , XU Z Z , CHANDRAMOHAN M , et al . Accurate and scalable cross-architecture cross-OS binary code search with emulation [J ] . IEEE Transactions on Software Engineering , 2019 , 45 ( 11 ): 1125 - 1149 .

DING S H H , FUNG B C M , CHARLAND P . Asm2Vec: boosting static representation robustness for binary clone search against code obfuscation and compiler optimization [C ] // Proceedings of the 2019 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2019 : 472 - 489 .

DUAN Y , LI X , WANG J H , et al . DeepBinDiff: learning program-wide code representations for binary diffing [C ] // Proceedings 2020 Network and Distributed System Security Symposium . Internet Society , 2020 .

KIM D , KIM E , CHA S K , et al . Revisiting binary code similarity analysis using interpretable feature engineering and lessons learned [J ] . IEEE Transactions on Software Engineering , 2023 , 49 ( 4 ): 1661 - 1682 .

GAO J , YANG X , FU Y , et al . VulSeeker-pro: enhanced semantic learning based binary vulnerability seeker with emulation [C ] // Proceedings of the 2018 26th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering . New York : ACM , 2018 : 803 - 808 .

GAO J , JIANG Y , LIU Z , et al . Semantic learning and emulation based cross-platform binary vulnerability seeker [J ] . IEEE Transactions on Software Engineering , 2021 , 47 ( 11 ): 2575 - 2589 .

CHENG X , ZHANG G Q , WANG H Y , et al . Path-sensitive code embedding via contrastive learning for software vulnerability detection [C ] // Proceedings of the 31st ACM SIGSOFT International Symposium on Software Testing and Analysis . New York : ACM , 2022 : 519 - 531 .

YAMAGUCHI F , GOLDE N , ARP D , et al . Modeling and discovering vulnerabilities with code property graphs [C ] // Proceedings of the 2014 IEEE Symposium on Security and Privacy . Piscataway : IEEE Press , 2014 : 590 - 604 .

SUN H , CUI L , LI L , et al . VDSimilar: Vulnerability detection based on code similarity of vulnerabilities and patches [J ] . Computers & Security , 2021 , 110 : 102417 .

THAPA C , JANG S I , AHMED M E , et al . Transformer-based language models for software vulnerability detection [C ] // Proceedings of the 38th Annual Computer Security Applications Conference . New York : ACM , 2022 : 481 - 496 .

FU M , TANTITHAMTHAVORN C . LineVul: a transformer-based line-level vulnerability prediction [C ] // Proceedings of the 2022 IEEE/ACM 19th International Conference on Mining Software Repositories (MSR) . Piscataway : IEEE Press , 2022 : 608 - 620 .

FU M , TANTITHAMTHAVORN C , LE T , et al . AIBugHunter: a Practical tool for predicting, classifying and repairing software vulnerabilities [J ] . Empirical Software Engineering , 2023 , 29 ( 1 ): 4 .

LIU B C , HUO W , ZHANG C , et al . αDiff: cross-version binary code similarity detection with DNN [C ] // Proceedings of the 33rd ACM/IEEE International Conference on Automated Software Engineering . New York : ACM , 2018 : 667 - 678 .

PEI K X , XUAN Z , YANG J F , et al . Learning approximate execution semantics from traces for binary function similarity [J ] . IEEE Transactions on Software Engineering , 2023 , 49 ( 4 ): 2776 - 2790 .

JIANG X Z , WANG S , GONG Y X , et al . HAformer: Semantic fusion of hex machine code and assembly code for cross-architecture binary vulnerability detection [J ] . Computers & Security , 2024 , 145 : 104029 .

李赞 , 边攀 , 石文昌 , 等 . 一种利用补丁的未知漏洞发现方法 [J ] . 软件学报 , 2018 , 29 ( 5 ): 1199 - 1212 .

LI Z , BIAN P , SHI W C , et al . Approach of leveraging patches to discover unknown vulnerabilities [J ] . Journal of Software , 2018 , 29 ( 5 ): 1199 - 1212 .

WOO S H , CHOI E J , LEE H J , et al . V1SCAN: Discovering 1-day vulnerabilities in reused C/C++ open-source software components using code classification techniques [C ] // 32nd USENIX Security Symposium . 2023 : 6541 - 6556 .

WOO S , PARK S , KIM S , et al . CENTRIS: a precise and scalable approach for identifying modified open-source software reuse [C ] // Proceedings of the 2021 IEEE/ACM 43rd International Conference on Software Engineering (ICSE) . Piscataway : IEEE Press , 2021 : 860 - 872 .

陈昱 , 刘中金 , 赵威威 , 等 . 一种大规模的跨平台同源二进制文件检索方法 [J ] . 计算机研究与发展 , 2018 , 55 ( 7 ): 1498 - 1507 .

CHEN Y , LIU Z J , ZHAO W W , et al . A large-scale cross-platform homologous binary retrieval method [J ] . Journal of Computer Research and Development , 2018 , 55 ( 7 ): 1498 - 1507 .

LIN G J , ZHANG J , LUO W , et al . Software vulnerability discovery via learning multi-domain knowledge bases [J ] . IEEE Transactions on Dependable and Secure Computing , 2021 , 18 ( 5 ): 2469 - 2485 .

LIU S G , LIN G J , QU L Z , et al . CD-VulD: cross-domain vulnerability discovery based on deep domain adaptation [J ] . IEEE Transactions on Dependable and Secure Computing , 2022 , 19 ( 1 ): 438 - 451 .

ZHANG J W , LIU Z X , HU X , et al . Vulnerability detection by learning from syntax-based execution paths of code [J ] . IEEE Transactions on Software Engineering , 2023 , 49 ( 8 ): 4196 - 4212 . ]

WANG X D , SUN K , BATCHELLER A , et al . Detecting “0-day” vulnerability: an empirical study of secret security patch in OSS [C ] // Proceedings of the 2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) . Piscataway : IEEE Press , 2019 : 485 - 492 .

ZOU D Q , WANG S J , XU S H , et al . $\mu$μVulDeePecker: a deep learning-based system for multiclass vulnerability detection [J ] . IEEE Transactions on Dependable and Secure Computing , 2021 , 18 ( 5 ): 2224 - 2236 .

段旭 , 吴敬征 , 罗天悦 , 等 . 基于代码属性图及注意力双向LSTM的漏洞挖掘方法 [J ] . 软件学报 , 2020 , 31 ( 11 ): 3404 - 3420 .

DUAN X , WU J Z , LUO T Y , et al . Vulnerability mining method based on code property graph and attention BiLSTM [J ] . Journal of Software , 2020 , 31 ( 11 ): 3404 - 3420 .

WU Y M , ZOU D Q , DOU S H , et al . VulCNN: an image-inspired scalable vulnerability detection system [C ] // Proceedings of the 2022 IEEE/ACM 44th International Conference on Software Engineering (ICSE) . Piscataway : IEEE Press , 2022 : 2365 - 2376 .

ZOU D Q , HU Y T , LI W K , et al . mVulPreter: a multi-granularity vulnerability detection system with interpretations [J ] . IEEE Transactions on Dependable and Secure Computing , 2022 , ( 99 ): 1 - 12 .

YUAN B , LU Y F , FANG Y L , et al . Enhancing deep learning-based vulnerability detection by building behavior graph model [C ] // Proceedings of the 2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE) . Piscataway : IEEE Press , 2023 : 2262 - 2274 . .

WANG S , WANG X D , SUN K , et al . GraphSPD: graph-based security patch detection with enriched code semantics [C ] // Proceedings of the 2023 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2023 : 2409 - 2426 .

ZHANG C Y , LIU B , XIN Y , et al . CPVD: cross project vulnerability detection based on graph attention network and domain adaptation [J ] . IEEE Transactions on Software Engineering , 2023 , 49 ( 8 ): 4152 - 4168 .

LI X , XIN Y , ZHU H L , et al . Cross-domain vulnerability detection using graph embedding and domain adaptation [J ] . Computers & Security , 2023 , 125 : 103017 .

BOWMAN B , HUANG H H . VGRAPH: a robust vulnerable code clone detection system using code property triplets [C ] // Proceedings of the 2020 IEEE European Symposium on Security and Privacy (EuroS&P) . Piscataway : IEEE Press , 2020 : 53 - 69 .

LIU B C , MENG G Z , ZOU W , et al . A large-scale empirical study on vulnerability distribution within projects and the lessons learned [C ] // Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering . New York : ACM , 2020 : 1547 - 1559 .

KANG W , SON B , HEO K . TRACER: signature-based static analysis for detecting recurring vulnerabilities [C ] // Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2022 : 1695 - 1708 .

STEENHOEK B , GAO H Y , LE W . Dataflow analysis-inspired deep learning for efficient vulnerability detection [C ] // Proceedings of the IEEE/ACM 46th International Conference on Software Engineering . New York : ACM , 2024 : 1 - 13 .

WEN X C , GAO C Y , YE J X , et al . Meta-path based attentional graph learning model for vulnerability detection [J ] . IEEE Transactions on Software Engineering , 2024 , 50 ( 3 ): 360 - 375 .

MACHIRY A , REDINI N , CAMELLINI E , et al . SPIDER: enabling fast patch propagation in related software repositories [C ] // Proceedings of the 2020 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2020 : 1562 - 1579 .

WANG Y S , SHEN J J , LIN J , et al . Staged method of code similarity analysis for firmware vulnerability detection [J ] . IEEE Access , 2019 , 7 : 14171 - 14185 .

YUAN Z M , FENG M Y , LI F , et al . B2SFinder: detecting open-source software reuse in COTS software [C ] // Proceedings of the 2019 34th IEEE/ACM International Conference on Automated Software Engineering (ASE) . Piscataway : IEEE Press , 2019 : 1038 - 1049 .

DU X N , CHEN B H , LI Y K , et al . LEOPARD: identifying vulnerable code for vulnerability assessment through program metrics [C ] // Proceedings of the 2019 IEEE/ACM 41st International Conference on Software Engineering (ICSE) . Piscataway : IEEE Press , 2019 : 60 - 71 .

CHINTHANET B , PONTA S E , PLATE H , et al . Code-based vulnerability detection in node.js applications: how far are we [C ] // Proceedings of the 35th IEEE/ACM International Conference on Automated Software Engineering . New York : ACM , 2020 : 1199 - 1203 .

LI Y , WANG S H , NGUYEN T N . Vulnerability detection with fine-grained interpretations [C ] // Proceedings of the 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering . New York : ACM , 2021 : 292 - 303 .

LI Z , ZOU D Q , XU S H , et al . SySeVR: a framework for using deep learning to detect software vulnerabilities [J ] . IEEE Transactions on Dependable and Secure Computing , 2022 , 19 ( 4 ): 2244 - 2258 .

CAO S C , SUN X B , BO L L , et al . MVD: memory-related vulnerability detection based on flow-sensitive graph neural networks [C ] // Proceedings of the 2022 IEEE/ACM 44th International Conference on Software Engineering (ICSE) . Piscataway : IEEE Press , 2022 : 1456 - 1468 .

WANG W B , NGUYEN T N , WANG S H , et al . DeepVD: toward class-separation features for neural network vulnerability detection [C ] // Proceedings of the 2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE) . Piscataway : IEEE Press , 2023 : 2249 - 2261 .

FAN Y H , WAN C H , FU C , et al . VDoTR: Vulnerability detection based on tensor representation of comprehensive code graphs [J ] . Computers & Security , 2023 , 130 : 103247 .

杨宏宇 , 杨海云 , 张良 , 等 . 基于特征依赖图的源代码漏洞检测方法 [J ] . 通信学报 , 2023 , 44 ( 1 ): 103 - 117 .

YANG H Y , YANG H Y , ZHANG L , et al . Feature dependence graph based source code loophole detection method [J ] . Journal on Communications , 2023 , 44 ( 1 ): 103 - 117 .

LIU Z X , TANG Z J , ZHANG J W , et al . Pre-training by predicting program dependencies for vulnerability analysis tasks [C ] // Proceedings of the IEEE/ACM 46th International Conference on Software Engineering . New York : ACM , 2024 : 1 - 13 .

WEN X C , GAO C Y , LUO F , et al . LIVABLE: exploring long-tailed classification of software vulnerability types [J ] . IEEE Transactions on Software Engineering , 2024 , 50 ( 6 ): 1325 - 1339 .

QIU F C , LIU Z X , HU X , et al . Vulnerability detection via multiple-graph-based code representation [J ] . IEEE Transactions on Software Engineering , 2024 , 50 ( 8 ): 2178 - 2199 .

SHAO M M , DING Y X . {FVD-DPM}: Fine-grained Vulnerability Detection via Conditional Diffusion Probabilistic Models [C ] // 33rd USENIX Security Symposium . 2024 : 7375 - 7392 .

SHIMMI S , RAHMAN A , GADDE M , et al . {VulSim}: Leveraging Similarity of {Multi-Dimensional} Neighbor Embeddings for Vulnerability Detection [C ] // 33rd USENIX Security Symposium (USENIX Security 24). 2024 : 1777 - 1794 .

MIKOLOV T , CHEN K , CORRADO G , et al . Efficient estimation of word representations in vector space [J ] . arXiv preprint arXiv: 1301.3781 , 2013 .

BROMLEY J , BENTZ JW , BOTTOU L , et al . Signature verification using a" siamese" time delay neural network [J ] . Advances in neural information processing systems , 1993 , 6 .

VASWANI A , SHAZEER N , PARMAR N , et al . Attention is all you need [J ] . Advances in neural information processing systems , 2017 , 30 .

DEVLIN J , CHANG M W , LEE K , et al . Bert: Pre-training of deep bidirectional transformers for language understanding [J ] . arXiv preprint arXiv: 1810.04805 , 2018 .

LIU Y , OTT M , GOYAL N , et al . Roberta: A robustly optimized bert pretraining approach [J ] . arXiv preprint arXiv: 1907.11692 , 2019 .

Ctags [EB ] . 2023

XU Y H , PAN S J , XIONG H , et al . A unified framework for metric transfer learning [J ] . IEEE Transactions on Knowledge and Data Engineering , 2017 , 29 ( 6 ): 1158 - 1171 .

FENG Z Y , GUO D Y , TANG D Y , et al . Codebert: A pre-trained model for programming and natural languages [J ] . arXiv preprint arXiv: 2002.08155 , 2020 .

WANG W H , LI G , MA B , et al . Detecting code clones with graph neural network and flow-augmented abstract syntax tree [C ] // Proceedings of the 2020 IEEE 27th International Conference on Software Analysis, Evolution and Reengineering (SANER) . Piscataway : IEEE Press , 2020 : 261 - 271 .

ROSENBLUM N , MILLER B P , ZHU X J . Recovering the toolchain provenance of binary code [C ] // Proceedings of the 2011 International Symposium on Software Testing and Analysis . New York : ACM , 2011 : 100 - 110 .

PAGLIARDINI M , GUPTA P , JAGGI M . Unsupervised learning of sentence embeddings using compositional n-gram features [J ] . arXiv preprint arXiv: 1703.02507 , 2017 .

LE Q V , MIKOLOV T . Distributed representations of sentences and documents [C ] // International conference on machine learning . PMLR , 2014 : 1188 - 1196 .

PENNINGTON J , SOCHER R , MANNING C . Glove: global vectors for word representation [C ] // Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing (EMNLP) . Stroudsburg, PA, USA : ACL , 2014 : 1532 - 1543 .

DAI H J , DAI B , SONG L . Discriminative embeddings of latent variable models for structured data [C ] // International conference on machine learning . PMLR , 2016 : 2702 - 2711 .

GROVER A , LESKOVEC J . node2vec: scalable feature learning for networks [C ] // Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining . New York : ACM , 2016 : 855 - 864 .

HU Z N , DONG Y X , WANG K S , et al . Heterogeneous graph transformer [C ] // Proceedings of the Proceedings of The Web Conference 2020 . New York : ACM , 2020 : 2704 - 2710 .

RADFORD A , NARASIMHAN K , SALIMANS T , et al . Improving language understanding by generative pre-training [J ] . 2018 .

LI Y J , ZEMEL R , BROCKSCHMIDT M , et al . gated graph sequence neural networks [C ] // Proceedings of ICLR'16 . 2016 .

BERG RVD , KIPF T N , WELLING M . Graph convolutional matrix completion [J ] . arXiv e-prints , 2017 : arXiv: 1706.02263 .

VELIČKOVIĆ P , CUCURULL G , CASANOVA A , et al . Graph attention networks [J ] . arXiv preprint arXiv: 1710.10903 , 2017 .

XU X J , LIU C , FENG Q , et al . Neural network-based graph embedding for cross-platform binary code similarity detection [C ] // Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2017 : 363 - 376 .

YING R , BOURGEOIS D , YOU J X , et al . GNNExplainer: generating explanations for graph neural networks [J ] . Advances in Neural Information Processing Systems , 2019 , 32 : 9240 - 9251 .

CHATTOPADHAY A , SARKAR A , HOWLADER P , et al . Grad-CAM: generalized gradient-based visual explanations for deep convolutional networks [C ] // Proceedings of the 2018 IEEE Winter Conference on Applications of Computer Vision (WACV) . Piscataway : IEEE Press , 2018 : 839 - 847 .

GUI Y , WAN Y , ZHANG H Y , et al . Cross-language binary-source code matching with intermediate representations [C ] // Proceedings of the 2022 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER) . Piscataway : IEEE Press , 2022 : 601 - 612 .

CHEN T Y , LI L , QIAN T T , et al . Identifying vulnerability patches by comprehending code commits with comprehensive change contexts [J ] . arXiv preprint arXiv: 2310.02530 , 2023 .

GAO Z Y , WANG H , ZHOU Y C , et al . How far have we gone in vulnerability detection using large language models [J ] . arXiv preprint arXiv: 2311.12420 , 2023 .

ZHANG C Y , LIU H , ZENG J Y , et al . Prompt-enhanced software vulnerability detection using chatgpt [J ] . arXiv preprint arXiv: 2308.12697 , 2023 .

BAKHSHANDEH A , KERAMATFAR A , NOROUZI A , et al . Using chatgpt as a static application security testing tool [J ] . arXiv preprint arXiv: 2308.14434 , 2023 .

CHESHKOV A , ZADOROZHNY P , LEVICHEV R . Evaluation of ChatGPT model for vulnerability detection [J ] . arXiv preprint arXiv: 2304.07232 , 2023 .

FU M , TANTITHAMTHAVORN C , NGUYEN V , et al . ChatGPT for vulnerability detection, classification, and repair: how far are we [EB ] . 2023 .

145 ] WANG X , WU Y X , ZHANG A , et al . Reinforced causal explainer for graph neural networks [J ] . IEEE Transactions on Pattern Analysis and Machine Intelligence , 2023 , 45 ( 2 ): 2297 - 2309 .

BARKAN O , ASHER Y , ESHEL A , et al . Learning to explain: a model-agnostic framework for explaining black box models [C ] // Proceedings of the 2023 IEEE International Conference on Data Mining (ICDM) . Piscataway : IEEE Press , 2023 : 944 - 949 .

刘航天 , 甘水滔 , 张超 , 等 . 物联网设备固件自动化漏洞挖掘技术研究综述 [J ] . 网络与信息安全学报 , 2025 , 11 ( 2 ): 26 - 49 .

LIU H T , GAN S T , ZHANG C , et al . Survey on automated vulnerability mining techniques for IoT device firmware [J ] . Chinese Journal of Network and Information Security , 2025 , 11 ( 2 ): 26 - 49 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于图神经网络的代码漏洞检测方法

DNS异常检测：大规模实验分析

基于扩散模型的机器学习后门攻击防御方法

基于垂直分割的个人数据隐私保护方法

基于数据增强的多视图对比学习图异常检测