期刊
IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING
卷 19, 期 4, 页码 2244-2258出版社
IEEE COMPUTER SOC
DOI: 10.1109/TDSC.2021.3051525
关键词
Deep learning; Syntactics; Software; Semantics; Proposals; Image processing; Big Data; Vulnerability detection; security; deep learning; program analysis; program representation
类别
资金
- National Natural Science Foundation of China [U1936211, 61802106]
- Natural Science Foundation of Hebei Province [F2020201016]
- ARO [W911NF-17-1-0566]
- NSF [1814825, 1736209]
This article introduces a systematic framework for using deep learning to detect vulnerabilities in C/C++ programs. Through experiments, the practicality of the framework is demonstrated, and several previously unreported vulnerabilities are successfully detected.
The detection of software vulnerabilities (or vulnerabilities for short) is an important problem that has yet to be tackled, as manifested by the many vulnerabilities reported on a daily basis. This calls for machine learning methods for vulnerability detection. Deep learning is attractive for this purpose because it alleviates the requirement to manually define features. Despite the tremendous success of deep learning in other application domains, its applicability to vulnerability detection is not systematically understood. In order to fill this void, we propose the first systematic framework for using deep learning to detect vulnerabilities in C/C++ programs with source code. The framework, dubbed Syntax-based, Semantics-based, and Vector Representations (SySeVR), focuses on obtaining program representations that can accommodate syntax and semantic information pertinent to vulnerabilities. Our experiments with four software products demonstrate the usefulness of the framework: we detect 15 vulnerabilities that are not reported in the National Vulnerability Database. Among these 15 vulnerabilities, seven are unknown and have been reported to the vendors, and the other eight have been silently patched by the vendors when releasing newer versions of the pertinent software products.
作者
我是这篇论文的作者
点击您的名字以认领此论文并将其添加到您的个人资料中。
推荐
暂无数据