摘要
为了对漏洞进行细粒度检测,理想的模型必须确定软件是否包含漏洞,并确定漏洞的类型(即进行漏洞分类).一系列深度学习模型在漏洞分类任务中取得了良好的整体性能.然而,观察到不同漏洞类型之间存在严重的数据不平衡.许多漏洞类型只有少量的漏洞样本(称为少样本类型),这导致了对少样本类型的分类性能和泛化能力较差.为了提高少样本漏洞类型的分类性能,实现VulFewShot.这种基于对比学习的漏洞分类框架通过使相同类型的漏洞样本“接近”,同时使不同类型的漏洞样本彼此“远离”,从而为仅有少数漏洞样本类型赋予了更多的权重.实验结果表明,VulFewShot可以提高对所有类型漏洞的分类性能.类型包含的漏洞样本数量越少,改进就越显著.因此,VulFewShot可以提高样本不足的漏洞的分类性能,并减少样本量对学习过程的影响.
To perform fine-grained vulnerability detection,an ideal model must determine whether software contains vulnerabilities and identify the type of vulnerability(i.e.,perform vulnerability classification).A series of deep learning models have demonstrated strong overall performance in vulnerability classification tasks.However,a severe data imbalance exists across different vulnerability types.Many vulnerability types are represented by only a small number of samples(referred to as few-shot types in this study),resulting in poor classification performance and generalization for these few-shot types.To enhance classification performance for these types,VulFewShot is proposed.This contrastive learning-based vulnerability classification framework assigns more weight to few-shot types by bringing samples of the same type closer together while keeping samples from different types further apart.Experimental results show that VulFewShot improves classification performance across all vulnerability types.The smaller the number of samples for a given type,the more significant the improvement.Therefore,VulFewShot improves classification performance for vulnerabilities with limited samples and mitigates the impact of sample size on the learning process.
作者
吴月明
张笑睿
李志
刘恺麟
邹德清
金海
WU Yue-Ming;ZHANG Xiao-Rui;LI Zhi;LIU Kai-Lin;ZOU De-Qing;JIN Hai(National Engineering Research Center for Big Data Technology and System,Wuhan 430074,China;Services Computing Technology and System Lab,Wuhan 430074,China;Hubei Key Laboratory of Distributed System Security,Wuhan 430074,China;Hubei Engineering Research Center on Big Data Security,Wuhan 430074,China;Jinyinhu Laboratory,Wuhan 430074,China;Cluster and Grid Computing Lab,Wuhan 430074,China;School of Cyber Science and Engineering,Huazhong University of Science and Technology,Wuhan 430074,China;School of Computer Science and Technology,Huazhong University of Science and Technology,Wuhan 430074,China)
出处
《软件学报》
北大核心
2025年第12期5495-5511,共17页
Journal of Software
基金
国家自然科学基金(62202191)。
关键词
漏洞分类
少样本
对比学习
vulnerability classification
few shot
contrastive learning
