(Partial) Program Dependence Learning
(Partial) Program Dependence Learning
复制标题
DOI：
10.1109/icse48619.2023.00209
复制
发表时间：
2023-05
期刊：
影响因子：
--
通讯作者：
Aashish Yadavally;T. Nguyen;Wenbo Wang;Shaohua Wang
中科院分区：
文献类型：
--
作者：
Aashish Yadavally;T. Nguyen;Wenbo Wang;Shaohua Wang
由于代码重用实践，来自开发人员论坛的代码片段经常迁移到应用程序。由于此类程序的不完整性质，分析它们以及早确定潜在漏洞的存在具有挑战性。在这项工作中，我们介绍了 NeuralPDA，一种基于神经网络的程序依赖性分析工具，适用于完整程序和部分程序。我们的工具有效地将语句内和语句间上下文特征合并到语句表示中，从而将程序依赖性分析建模为语句对依赖性解码任务。在实证评估中，我们报告 NeuralPDA 预测完整 Java 和 C/C++ 代码中的 CFG 和 PDG 边缘，综合 F 分数分别为 94.29% 和 92.46%。部分 Java 和 C/C++ 代码的 F 分数范围分别为 94.29%-97.17% 和 92.46%-96.01%。我们还测试了 NeuralPDA 预测的 PDG（即 PDG*）在方法级漏洞检测的下游任务中的有用性。我们发现，利用 PDG* 的漏洞检测工具的性能仅比利用程序分析工具生成的 PDG 的漏洞检测工具低 1.1%。我们还报告了基于机器学习的漏洞检测工具从 StackOverflow 检测到的 14 个现实世界的易受攻击的代码片段，该工具采用 NeuralPDA 为这些代码片段预测的 PDG。
Code fragments from developer forums often migrate to applications due to the code reuse practice. Owing to the incomplete nature of such programs, analyzing them to early determine the presence of potential vulnerabilities is challenging. In this work, we introduce NeuralPDA, a neural network-based program dependence analysis tool for both complete and partial programs. Our tool efficiently incorporates intra-statement and inter-statement contextual features into statement representations, thereby modeling program dependence analysis as a statement-pair dependence decoding task. In the empirical evaluation, we report that NeuralPDA predicts the CFG and PDG edges in complete Java and C/C++ code with combined F-scores of 94.29% and 92.46%, respectively. The F-score values for partial Java and C/C++ code range from 94.29%-97.17% and 92.46%-96.01%, respectively. We also test the usefulness of the PDGs predicted by NeuralPDA (i.e., PDG*) on the downstream task of method-level vulnerability detection. We discover that the performance of the vulnerability detection tool utilizing PDG* is only 1.1% less than that utilizing the PDGs generated by a program analysis tool. We also report the detection of 14 real-world vulnerable code snippets from StackOverflow by a machine learning-based vulnerability detection tool that employs the PDGs predicted by NeuralPDA for these code snippets.