GraphSPD: Graph-Based Security Patch Detection with Enriched Code Semantics
GraphSPD: Graph-Based Security Patch Detection with Enriched Code Semantics
复制标题
DOI：
10.1109/sp46215.2023.10179479
复制
发表时间：
2023-05
期刊：
影响因子：
--
通讯作者：
Shu Wang;Xinda Wang;Kun Sun;S. Jajodia;Haining Wang;Qi Li
中科院分区：
文献类型：
--
作者：
Shu Wang;Xinda Wang;Kun Sun;S. Jajodia;Haining Wang;Qi Li
随着开源软件的日益普及，嵌入式漏洞已广泛传播到下游软件。由于不同的维护策略，软件供应商可以无需提供足够的咨询（例如CVE）而默默释放安全补丁。这使用户不知道安全补丁，并为攻击者提供了充分利用未解决漏洞的机会。因此，检测这些无声安全补丁对于安全软件维护至关重要。在本文中，我们提出了一个名为GraphSpd的基于图形神经网络的安全贴片检测系统，该系统将贴片表示为具有更丰富语义的图形，并利用了一个贴片 - 泰式图形模型进行检测。我们首先开发了一种称为PatchCPG的新颖图形结构，以通过合并两个代码属性图（CPG）为patch和patch源源代码，并保留上下文，删除并添加了补丁的组件，来表示软件补丁。通过应用切片技术，我们保留最相关的上下文并减少PatchCPG的大小。然后，我们开发了一个称为PatchGnn的第一个端到端深度学习模型，以确定一个补丁是否从其图形结构的PatchCPG直接与安全相关。 PatchGnn包括一个新的嵌入过程，将PatchCPG转换为数字格式和一种新的多物图卷积机制，以适应PatchCPG中的各种关系。实验结果表明，GraphSPD可以显着胜过安全贴片检测的最新方法。
With the increasing popularity of open-source software, embedded vulnerabilities have been widely propagating to downstream software. Due to different maintenance policies, software vendors may silently release security patches without providing sufficient advisories (e.g., CVE). This leaves users unaware of security patches and provides attackers good chances to exploit unpatched vulnerabilities. Thus, detecting those silent security patches becomes imperative for secure software maintenance. In this paper, we propose a graph neural network based security patch detection system named GraphSPD, which represents patches as graphs with richer semantics and utilizes a patch-tailored graph model for detection. We first develop a novel graph structure called PatchCPG to represent software patches by merging two code property graphs (CPGs) for the pre-patch and post-patch source code as well as retaining the context, deleted, and added components for the patch. By applying a slicing technique, we retain the most relevant context and reduce the size of PatchCPG. Then, we develop the first end-to-end deep learning model called PatchGNN to determine if a patch is security-related directly from its graph-structured PatchCPG. PatchGNN includes a new embedding process to convert PatchCPG into a numeric format and a new multi-attributed graph convolution mechanism to adapt diverse relationships in PatchCPG. The experimental results show GraphSPD can significantly outperform the state-of-the-art approaches on security patch detection.