基于图结构源代码切片的智能化漏洞检测系统

doi:10.11959/j.issn.2096-109x.2021088

网络与信息安全学报 ›› 2021, Vol. 7 ›› Issue (5): 113-122.doi: 10.11959/j.issn.2096-109x.2021088

基于图结构源代码切片的智能化漏洞检测系统

邹德清¹, 李响², 黄敏桓², 宋翔³, 李浩³, 李伟明⁴

¹ 华中科技大学网络空间安全学院，湖北武汉 430074
² 信息系统安全技术重点实验室，北京 100101
³ 华中科技大学软件学院，湖北武汉 430074
⁴ 华中科技大学网络与计算中心，湖北武汉 430074

修回日期:2021-09-10 出版日期:2021-10-15 发布日期:2021-10-01
作者简介:邹德清（1975− ），男，湖南浏阳人，华中科技大学教授、博士生导师，主要研究方向为系统与软件安全、云计算安全
李响（1983− ），女，河北涿州人，信息系统安全技术重点实验室高级工程师，主要研究方向为软件脆弱性分析、恶意代码检测
黄敏桓（1971− ），男，江西万载人，信息系统安全技术重点实验室研究员，主要研究方向为脆弱性自动分析、网络安全评估与验证
宋翔（1996− ），男，河南新乡人，华中科技大学硕士生，主要研究方向为网络安全
李浩（1995− ），男，河南驻马店人，华中科技大学硕士生，主要研究方向为网络安全
李伟明（1975− ），男，湖南株洲人，华中科技大学副教授，主要研究方向为网络安全
基金资助:
国家自然科学基金(U1936211)

Intelligent vulnerability detection system based on graph structured source code slice

Deqing ZOU¹, Xiang LI², Minhuan HUANG², Xiang SONG³, Hao LI³, Weiming LI⁴

¹ School of Cyber Science and Engineering, Huazhong University of Science and Technology, Wuhan 430074, China
² National Key Laboratory of Science and Technology on Information System Security, Beijing 100101, China
³ School of Software Engineering, Huazhong University of Science and Technology, Wuhan 430074, China
⁴ Network and Computation Center, Huazhong University of Science and Technology, Wuhan 430074, China

Revised:2021-09-10 Online:2021-10-15 Published:2021-10-01
Supported by:
The National Nature Science Foundation of China(U1936211)

摘要/Abstract

摘要：

针对智能化漏洞检测，从源代码程序依赖图中根据漏洞特征提取图结构源代码切片，将图结构切片信息表征后利用图神经网络模型进行漏洞检测工作。实现了切片级的漏洞检测，并在代码行级预测漏洞行位置。为了验证系统的有效性，分别与静态漏洞检测系统、基于序列化文本信息和基于图结构化信息的漏洞检测系统做比较，实验结果表明，所提系统在漏洞检测能力上有较高准确性，并且在漏洞代码行预测工作上有较好表现。

关键词: 漏洞检测, 图结构, 代码切片, 深度学习

Abstract:

For the intelligent vulnerability detection, the system extracts the graph structured source code slices according to the vulnerability characteristics from the program dependency graph of source code, and then presents the graph structured slice information to carry out vulnerability detection by using the graph neural network model.Slice level vulnerability detection was realized and the vulnerability line was located at the code line level.In order to verify the effectiveness of the system, compared with the static vulnerability detection systems, the vulnerability detection system based on serialized text information, and the vulnerability detection system based on graph structured information, the experimental results show that the proposed system has a high accuracy in the vulnerability detection capability and a good performance in the vulnerability code line prediction.

Key words: vulnerability detection, graph structure, code slice, deep learning

中图分类号:

TP393

邹德清, 李响, 黄敏桓, 宋翔, 李浩, 李伟明. 基于图结构源代码切片的智能化漏洞检测系统[J]. 网络与信息安全学报, 2021, 7(5): 113-122.

Deqing ZOU, Xiang LI, Minhuan HUANG, Xiang SONG, Hao LI, Weiming LI. Intelligent vulnerability detection system based on graph structured source code slice[J]. Chinese Journal of Network and Information Security, 2021, 7(5): 113-122.

图/表 7

图1

图2

图3

表1

表2

表3

表4

参考文献 21

[1]	李韵, 黄辰林, 王中锋 ,等. 基于机器学习的软件漏洞挖掘方法综述[J]. 软件学报, 2020,31(7): 2040-2061.
	LI Y , HUANG C L , WANG Z F ,et al. Survey of software vulnerability mining methods based on machine learning[J]. Journal of Software, 2020,31(7): 2040-2061.
[2]	陈肇炫, 邹德清, 李珍 ,等. 基于抽象语法树的智能化漏洞检测系统[J]. 信息安全学报, 2020,5(4): 1-13.
	CHEN Z X , ZOU D Q , LI Z ,et al. Intelligent vulnerability detection system based on abstract syntax tree[J]. Journal of Cyber Security, 2020,5(4): 1-13.
[3]	LI Z , ZOU D Q , XU S H ,et al. VulDeePecker:a deep learning-based system for vulnerability detection[C]// The Network and Distributed System Security Symposium. 2018.
[4]	XIAO Y , CHEN B H , YU C D ,et al. MVP:Detecting vulnerabilities using patch-enhanced vulnerability signatures[C]// USENIX Security Symposium. 2018.
[5]	GUSTAVO G , GUILLERMO L G , UZAL L ,et al. Toward large-scale vulnerability discovery using machine learning[C]// The 6th ACM on Conference on Data and Application Security and Privacy (CODASPY'16). 2016: 85-96.
[6]	STEPHAN N , THOMAS Z , CHRISTIAN H ,et al. Predicting vulnerable software components[C]// 2007 ACM Conference on Computer and Communications Security (CCS'07). 2007: 529-540.
[7]	FABIAN Y , MARKUS L , KONRAD R . Generalized vulnerability extrapolation using abstract syntax trees[C]// The 28th Annual Computer Security Applications Conference. 2012: 359-368.
[8]	FABIAN Y , ALWIN M , HUGO G ,et al. Automatic inference of search patterns for taint-style vulnerabilities[C]// IEEE Symposium on Security and Privacy (S＆P'15). 2015: 797-812.
[9]	ZOU D Q , WANG S J , XU S H ,et al. ?VulDeePecker:a deep learning-based system for multiclass vulnerability detection[J]. IEEE Transactions on Dependable and Secure Computing, 2021,15(5): 2224-2236.
[10]	LI Z , ZOU D Q , XU S H ,et al. VulDeeLocator:a deep learning-based fine-grained vulnerability detector[J]. IEEE Transactions on Dependable and Secure Computing, 2021.
[11]	LI Z , ZOU D Q , XU S H ,et al. SySeVR:a Framework for using deep learning to detect software vulnerabilities[J]. IEEE Transactions on Dependable and Secure Computing, 2021.
[12]	LIN G J , XIAO W , ZHANG J ,et al. Deep Learning-based vulnerable function detection:a benchmark[C]// The 21st International Conference on Information and Communications Security. 2019: 219-232.
[13]	LIN G J , ZHANG J , LUO W ,et al. POSTER:vulnerability discovery with function representation learning from unlabeled projects[C]// ACM SIGSAC Conference on Computer and Communications Security. 2017: 2539-2541.
[14]	LIN G J , ZHANG J , LUO W ,et al. Cross-project transfer representation learning for vulnerable function discovery[J]. IEEE Trans Industrial Informatics, 2018,14(7): 329-3297.
[15]	LIU S G , LIN G J , QU L Z ,et al. CD-VulD:cross-domain vulnerability discovery based on deep domain adaptation[J]. IEEE Transactions on Dependable and Secure Computing, 2020.
[16]	VAN N , TRUNG L , TUE L ,et al. Deep domain adaptation for vulnerable code function identification[C]// International Joint Conference on Neural Networks. 2019: 1-8.
[17]	REBECCA , LOUISK , LEI H , ET A L . Automated vulnerability detection in source code using deep representation learning[C]// The 17th IEEE International Conference on Machine Learning and Applications(ICMLA). 2018: 757-762.
[18]	TIM S , . Machine-learning supported vulnerability detection in source code[C]// The 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering(ESEC/FSE). 2019: 1180-1183.
[19]	WANG H T , YE G X , TANG Z Y ,et al. Combining graph-based learning with automated data collection for code vulnerability detection[J]. IEEE Transactions on Dependable and Secure Computing. 2020.
[20]	DUAN X , WU H , JI S L ,et al. VulSniper:focus your attention to shoot fine-grained vulnerabilities[C]// The 28th International Joint Conference on Artificial Intelligence. 2019: 4665-4671.
[21]	ZHOU Y Q , LIU S Q , SIOW J ,et al. Devign:effective vulnerability identification by learning comprehensive program semantics via graph neural networks[C]// Annual Conference on Neural Information Processing Systems(NeurIPS). 2019: 10197-10207.

池化比率	P	R	F1	IoU	\|V\|
0.50	91.7%	85.4%	88.4%	12.3%	2.2
0.60	93.2%	84.8%	88.8%	13.1%	3.7
0.65	92.8%	86.8%	89.7%	13.4%	4.7
0.70	89.2%	89.4%	89.3%	12.5%	5.5
0.80	93.7%	85.4%	89.4%	11.3%	8.1

检测系统	P	R	F1	IoU	\|V\|
SySeVR系统	84.6%	94.5%	89.3%	7.9%	13.3%
本文系统	92.8%	86.8%	89.7%	13.4%	4.7%

检测系统	P	R	F1
Devign系统	36.1%	100.0%	53.1%
本文系统	92.8%	86.8%	89.7%

检测系统	P	R	F1
RATS系统	12.8%	14.7%	13.7%
Flawfinder系统	22.8%	29.6%	25.7%
Checkmarx系统	30.9%	43.2%	36.1%
本文系统	92.8%	86.8%	89.7%

基于图结构源代码切片的智能化漏洞检测系统

Intelligent vulnerability detection system based on graph structured source code slice

在线阅读

pdf下载

可视化

摘要/Abstract

引用本文

使用本文

图/表 7

参考文献 21

相关文章 15

Metrics

推荐阅读 0

[1]	李晓萌, 郭玳豆, 卓训方, 姚恒, 秦川. 载体独立的抗屏摄信息膜叠加水印算法[J]. 网络与信息安全学报, 2023, 9(3): 135-149.
[2]	谢绒娜, 马铸鸿, 李宗俞, 田野. 基于卷积神经网络的加密流量分类方法[J]. 网络与信息安全学报, 2022, 8(6): 84-91.
[3]	章登勇, 文凰, 李峰, 曹鹏, 向凌云, 杨高波, 丁湘陵. 基于双分支网络的图像修复取证方法[J]. 网络与信息安全学报, 2022, 8(6): 110-122.
[4]	林佳滢, 周文柏, 张卫明, 俞能海. 空域频域相结合的唇型篡改检测方法[J]. 网络与信息安全学报, 2022, 8(6): 146-155.
[5]	穆超, 王鑫, 杨明, 张恒, 陈振娅, 吴晓明. 面向物联网设备固件的硬编码漏洞检测方法[J]. 网络与信息安全学报, 2022, 8(5): 98-110.
[6]	陈晋音, 吴长安, 郑海斌. 基于softmax激活变换的对抗防御方法[J]. 网络与信息安全学报, 2022, 8(2): 48-63.
[7]	邱宝琳, 易平. 基于多维特征图知识蒸馏的对抗样本防御方法[J]. 网络与信息安全学报, 2022, 8(2): 88-99.
[8]	李丽娟, 李曼, 毕红军, 周华春. 基于混合深度学习的多类型低速率DDoS攻击检测方法[J]. 网络与信息安全学报, 2022, 8(1): 73-85.
[9]	秦中元, 贺兆祥, 李涛, 陈立全. 基于图像重构的MNIST对抗样本防御算法[J]. 网络与信息安全学报, 2022, 8(1): 86-94.
[10]	王正龙, 张保稳. 生成对抗网络研究综述[J]. 网络与信息安全学报, 2021, 7(4): 68-85.
[11]	李炳龙, 佟金龙, 张宇, 孙怡峰, 王清贤, 常朝稳. 基于TensorFlow的恶意代码片段自动取证检测算法[J]. 网络与信息安全学报, 2021, 7(4): 154-163.
[12]	陈皓, 易平. 基于图神经网络的代码漏洞检测方法[J]. 网络与信息安全学报, 2021, 7(3): 37-45.
[13]	谭清尹, 曾颖明, 韩叶, 刘一静, 刘哲理. 神经网络后门攻击研究[J]. 网络与信息安全学报, 2021, 7(3): 46-58.
[14]	杨路辉,白惠文,刘光杰,戴跃伟. 基于可分离卷积的轻量级恶意域名检测模型[J]. 网络与信息安全学报, 2020, 6(6): 112-120.
[15]	刘西蒙,谢乐辉,王耀鹏,李旭如. 深度学习中的对抗攻击与防御[J]. 网络与信息安全学报, 2020, 6(5): 36-53.