Detection of Software Vulnerabilities using Machine Learning

使用机器学习检测软件漏洞

• 批准号: 242913835
• 负责人: Professor Dr. Konrad Rieck
• 金额: --
• 依托单位: Fachgebiet Maschinelles Lernen und IT-Sicherheit
• 依托单位国家: 德国
• 项目类别: Research Grants
• 财政年份: 2014
• 资助国家: 德国
• 起止时间: 2013-12-31 至 2016-12-31
• 项目状态: 已结题
• 来源: https://gepris.dfg.de/gepris/projekt/242913835?language=en
• 关键词: Detection; Software; Vulnerabilities; using; Machine

The early detection of vulnerabilities in software is a key for securing computer systems. While some types of security flaws can be identified automatically, the majority of vulnerabilities is still discovered by time-consuming manual analysis. This project aims at developing novel methods for vulnerability discovery using machine learning techniques. To this end, structured representations of code, such as parse trees and control flow graphs, are embedded in vector spaces and analyzed using unsupervised learning algorithms for semantic analysis and anomaly detection. This analysis should enable identifying typical programming patterns automatically and detecting potential vulnerabilities as deviations from these patterns.

早期检测软件中的漏洞是保护计算机系统的关键。虽然某些类型的安全漏洞可以自动识别，但大多数漏洞仍然是通过耗时的手动分析发现的。 该项目旨在使用机器学习技术开发新的漏洞发现方法。 为此，代码的结构化表示，如解析树和控制流图，被嵌入到向量空间中，并使用无监督学习算法进行语义分析和异常检测。这种分析应该能够自动识别典型的编程模式，并将潜在的漏洞检测为与这些模式的偏差。

项目成果

Twice the Bits, Twice the Trouble: Vulnerabilities Induced by Migrating to 64-Bit Platforms

• DOI: 10.1145/2976749.2978403
• 发表时间: 2016-10
• 期刊: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security
• 作者: Christian Wressnegger;Fabian Yamaguchi;Alwin Maier;Konrad Rieck

Automatic Inference of Search Patterns for Taint-Style Vulnerabilities

自动推断污染型漏洞的搜索模式

• DOI: 10.1109/sp.2015.54
• 发表时间: 2015
• 期刊: 2015 IEEE Symposium on Security and Privacy
• 作者: F. Yamaguchi;A. Maier;H. Gascon;K. Rieck
• 通讯作者: K. Rieck

Chucky: exposing missing checks in source code for vulnerability discovery

• DOI: 10.1145/2508859.2516665
• 发表时间: 2013-11
• 期刊: Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security
• 作者: Fabian Yamaguchi;Christian Wressnegger;Hugo Gascon;Konrad Rieck