Automated Vulnerability Detection in Source Code Using Quantum Natural Language Processing
Automated Vulnerability Detection in Source Code Using Quantum Natural Language Processing
复制标题
DOI：
10.1007/978-981-99-0272-9_6
复制
发表时间：
2023-03
期刊：
影响因子：
--
通讯作者：
Mst. Shapna Akter;Hossain Shahriar;Zakirul Alam Bhuiya
中科院分区：
文献类型：
--
作者：
Mst. Shapna Akter;Hossain Shahriar;Zakirul Alam Bhuiya
软件代码审计领域最重要的挑战之一是软件源代码中存在漏洞。每年都有越来越多的软件缺陷被发现，要么是在内部专有代码中，要么是公开披露的。这些缺陷极有可能被利用，并导致系统破坏、数据泄露或拒绝服务。现在可以使用C和c++开源代码，以便创建用于功能级漏洞识别的大规模，经典机器学习和量子机器学习系统。我们收集了一个相当大的数据集，其中包含数百万个指向潜在漏洞的开源函数。我们基于深度神经网络模型-长短期记忆（LSTM）和量子机器学习模型-长短期记忆（QLSTM）创建了一种高效且可扩展的漏洞检测方法，该方法可以学习从源代码中提取的特征。首先将源代码转换为最小的中间表示，以删除无意义的组件并缩短依赖关系。以前的研究缺乏对源代码特征的分析，这些特征导致模型在现实生活中识别缺陷。因此，我们使用最先进的词嵌入算法（如Glove和fastText）来保留语义和句法信息。随后将嵌入的向量输入到经典和量子卷积神经网络中，对可能的漏洞进行分类。为了度量性能，我们使用了诸如F1分数、精度、召回率、准确性和总执行时间等评估指标。我们使用基本特征表示以及语义和句法表示对经典LSTM和量子LSTM的结果进行了比较。我们发现，具有语义和语法特征的QLSTM能够非常准确地检测漏洞，并且运行速度比经典的QLSTM更快。
One of the most important challenges in the field of software code audit is the presence of vulnerabilities in software source code. Every year, more and more software flaws are found, either internally in proprietary code or revealed publicly. These flaws are highly likely exploited and lead to system compromise, data leakage, or denial of service. C and C++ open-source codes are now available in order to create a large-scale, classical machine-learning and quantum machine-learning system for function-level vulnerability identification. We assembled a sizable dataset of millions of open-source functions that point to potential exploits. We created an efficient and scalable vulnerability detection method based on a deep neural network model– Long Short-Term Memory (LSTM), and quantum machine learning model– Long Short-Term Memory (QLSTM), that can learn features extracted from the source codes. The source code is first converted into a minimal intermediate representation to remove the pointless components and shorten the dependency. Previous studies lack analyzing features of the source code that causes models to recognize flaws in real-life examples. Therefore, We keep the semantic and syntactic information using state-of-the-art word embedding algorithms such as Glove and fastText. The embedded vectors are subsequently fed into the classical and quantum convolutional neural networks to classify the possible vulnerabilities. To measure the performance, we used evaluation metrics such as F1 score, precision, recall, accuracy, and total execution time. We made a comparison between the results derived from the classical LSTM and quantum LSTM using basic feature representation as well as semantic and syntactic representation. We found that the QLSTM with semantic and syntactic features detects significantly accurate vulnerability and runs faster than its classical counterpart.