ICSD: An Automatic System for Insecure Code Snippet Detection in Stack Overflow over Heterogeneous Information Network
ICSD: An Automatic System for Insecure Code Snippet Detection in Stack Overflow over Heterogeneous Information Network
复制标题
DOI：
10.1145/3274694.3274742
复制
发表时间：
2018-12
期刊：
影响因子：
--
通讯作者：
Yanfang Ye;Shifu Hou;Lingwei Chen;X. Li;Liang Zhao;Shouhuai Xu;Jiabin Wang;Qi Xiong
中科院分区：
文献类型：
--
作者：
Yanfang Ye;Shifu Hou;Lingwei Chen;X. Li;Liang Zhao;Shouhuai Xu;Jiabin Wang;Qi Xiong
随着现代社会编码范式（如Stack Overflow）的普及，其潜在的安全风险也在增加（例如，不安全的代码可以容易地嵌入和分发）。为了解决这个被忽视的问题，在本文中，我们带来了一个重要的新见解，即除了代码内容之外，还利用社交编码属性来自动检测Stack Overflow中的不安全代码片段。为了确定给定的代码片段是否不安全，我们不仅分析代码内容，还利用Stack Overflow中用户，徽章，问题，答案，代码片段和关键字之间的各种关系。为了对丰富的语义关系进行建模，我们首先引入了一个结构化的异构信息网络（HIN）进行表示，然后使用基于元路径的方法将更高级别的语义，以建立代码片段的相关性。之后，我们提出了一种新的网络嵌入模型snippet2vec，用于HIN中的表示学习，其中HIN结构和语义都得到了最大限度的保留。在此基础上，构建了一个多视图融合分类器，用于不安全代码片段检测。据我们所知，这是第一个利用代码内容和社会编码属性来解决现代软件编码平台中的代码安全问题的工作。从堆栈溢出的数据收集进行全面的实验，以验证所开发的系统ICSD的有效性，它集成了我们提出的方法在不安全的代码片段检测与替代方法的比较。
As the popularity of modern social coding paradigm such as Stack Overflow grows, its potential security risks increase as well (e.g., insecure codes could be easily embedded and distributed). To address this largely overlooked issue, in this paper, we bring an important new insight to exploit social coding properties in addition to code content for automatic detection of insecure code snippets in Stack Overflow. To determine if the given code snippets are insecure, we not only analyze the code content, but also utilize various kinds of relations among users, badges, questions, answers, code snippets and keywords in Stack Overflow. To model the rich semantic relationships, we first introduce a structured heterogeneous information network (HIN) for representation and then use meta-path based approach to incorporate higher-level semantics to build up relatedness over code snippets. Later, we propose a novel network embedding model named snippet2vec for representation learning in HIN where both the HIN structures and semantics are maximally preserved. After that, a multi-view fusion classifier is constructed for insecure code snippet detection. To the best of our knowledge, this is the first work utilizing both code content and social coding properties to address the code security issues in modern software coding platforms. Comprehensive experiments on the data collections from Stack Overflow are conducted to validate the effectiveness of the developed system ICSD which integrates our proposed method in insecure code snippet detection by comparisons with alternative approaches.