An Unbiased Transformer Source Code Learning with Semantic Vulnerability Graph-猫眼课题宝

DOI：

10.1109/eurosp57164.2023.00018

发表时间：

2023-04

期刊：

2023 IEEE 8th European Symposium on Security and Privacy (EuroS&P)

影响因子：

通讯作者：

中科院分区：

其他

文献类型：

作者：

Nafis Tanveer Islam;G. Parra;Dylan Manuel;E. Bou-Harb;Peyman Najafirad

多年来，开源软件系统已成为威胁性参与者的猎物。为开发人员提供代码脆弱性和分类。 Neural network (GCN). We present a training process utilizing a semantic vulnerability graph (SVG) representation from source code, created by integrating edges from a sequential flow, control flow, and data flow, as well as a novel flow dubbed Poacher Flow (PF). Poacher flow edges reduce the gap between dynamic and static program analysis and handle complex long-range dependencies. Moreover, our approach reduces biases of classifiers regarding unbalanced datasets通过将焦点损失函数与SVG相结合，实验结果表明，我们的分类器的最先进的结果在较少的假否定范围内超过了脆弱性检测，并且在多个数据集中测试了我们的模型。 93％的准确性，能够从流行的GitHub存储库中检测到4，我们的代码和数据。

Over the years, open-source software systems have become prey to threat actors. Even highly-adopted software has been crippled by unforeseeable attacks, leaving millions of devices exposed. Even as open-source communities act quickly to patch the breach, code vulnerability screening should be an integral part of agile software development from the beginning. Unfortunately, current vulnerability screening techniques are ineffective at identifying novel vulnerabilities or providing developers with code vulnerability and classification. Furthermore, the datasets used for vulnerability learning often exhibit distribution shifts from the real-world testing distribution due to novel attack strategies deployed by adversaries and as a result, the machine learning model’s performance may be hindered or biased. To address these issues, we propose a joint interpolated multitasked unbiased vulnerability classifier comprising a transformer "RoBERTa" and graph convolution neural network (GCN). We present a training process utilizing a semantic vulnerability graph (SVG) representation from source code, created by integrating edges from a sequential flow, control flow, and data flow, as well as a novel flow dubbed Poacher Flow (PF). Poacher flow edges reduce the gap between dynamic and static program analysis and handle complex long-range dependencies. Moreover, our approach reduces biases of classifiers regarding unbalanced datasets by integrating Focal Loss objective function along with SVG. Remarkably, experimental results show that our classifier outperforms state-of-the-art results on vulnerability detection with fewer false negatives and false positives. After testing our model across multiple datasets, it shows an improvement of at least 2.41% and 18.75% in the best-case scenario. Evaluations using N-day program samples demonstrate that our proposed approach achieves a 93% accuracy and was able to detect 4, zero-day vulnerabilities from popular GitHub repositories. Our code and data are available at https://github.com/pial08/SemVulDet

An Unbiased Transformer Source Code Learning with Semantic Vulnerability Graph

文献摘要

相似文献