摘要
针对现有基于深度学习的源代码漏洞检测方法使用的代码切片不能全面覆盖漏洞类间细微差异特征,且单一深度学习检测模型对跨文件、跨函数代码语句间较长的上下文依赖信息学习能力不足的问题,提出一种多类型源代码漏洞检测方法。首先,基于程序依赖图中的控制依赖和数据依赖信息,抽取包含可区分漏洞类型的细粒度两级代码切片。其次,将两级切片转化为初始表示向量。最后,构建适用于两级代码切片的深度学习漏洞检测融合模型,实现对多类型源代码漏洞的准确检测。在多个合成数据集及2个真实数据上的实验结果表明,所提方法的检测效果优于现有的多类型源代码漏洞检测方法。
Given the problem that the code slice used by existing deep learning-based vulnerability sniffer methods could not comprehensively encompass the subtle characteristics between vulnerability classes,and a single deep learning sniffer model had insufficient ability to learn long context-dependent information between cross-file and cross-function code statements,a multi-type source code vulnerability sniffer method was proposed.Firstly,fine-grained two-level slices containing the types of vulnerabilities were extracted based on the control dependency and data dependency information in program dependency graph.Secondly,the two-level slices were transformed into initial feature vector.Finally,a fusion model of deep learning vulnerability sniffer suitable for two-level slices was constructed to achieve accurate vulnerability detection of multi-type source code.The experimental results on multiple synthetic datasets and two real datasets show that the proposed method outperforms the existing multi-type source code vulnerability sniffer methods.
作者
张学军
张奉鹤
盖继扬
杜晓刚
周文杰
蔡特立
赵博
ZHANG Xuejun;ZHANG Fenghe;GAI Jiyang;DU Xiaogang;ZHOU Wenjie;CAI Teli;ZHAO Bo(School of Electronic and Information Engineering,Lanzhou Jiaotong University,Lanzhou 730070,China;School of Electronic and Information and Artificial Intelligence,Shaanxi University of Science and Technology,Xi’an 710021,China;State Grid Gansu Electric Power Company,Lanzhou 730000,China)
出处
《通信学报》
EI
CSCD
北大核心
2023年第9期149-160,共12页
Journal on Communications
基金
国家自然科学基金资助项目(No.61762058)
甘肃省自然科学基金资助项目(No.21JR7RA282)
甘肃省教育厅产业支撑基金资助项目(No.2022CYZC-38)
国家电网科技基金资助项目(No.W32KJ2722010,No.522722220013)。
关键词
多类型漏洞检测
深度学习
注意力机制
数据依赖
控制依赖
multi-type vulnerabilities sniffer
deep learning
attention mechanism
data dependency
control dependency
