A Machine Learning Approach to Detecting Security Vulnerabilities in Software.

点击翻译按钮获取中文摘要

This proposal aims to explore a new way of detecting software vulnerabilities using a novel combination of program analysis, dynamic test generation and machine learning. Currently, one of the most reliable methods for detecting software vulnerabilities is source code audits, where a developer manually inspects the source code of a program to see if vulnerabilities are present. Unfortunately, software systems are large, commonly containing tens of millions of lines of code, making it an impossible task to secure all software through manual code audits. In this proposal, we explore a better way to detect software vulnerabilities--by developing machine learning methods that will identify software vulnerabilities.The key to enabling machine learning to outperform existing vulnerability detection tools is to recognize that there are common programming patterns, embedded in the structure of code, as well as in the names of variables and functions, that can indicate the presence of a vulnerability, but for which there exists no explicit specification. Current solutions that try to mechanize the scanning of code for vulnerabilities all rely only on what is explicitly specified by the programming language or application binary interface (ABI), and do not take these implicit code patterns into account. Some tools do allow a human to hand-specify vulnerability patterns to overcome this limitation, but the huge variation in vulnerability patterns means that even with these specifications, many vulnerabilities will be missed by automated vulnerability detection tools. The key novel approach in this proposal is to use machine learning to automatically learn and utilize programming patterns, embedded in code structure and variable names, that indicate the presence of a vulnerability and use this to automatically detect vulnerabilities in software with high accuracy.We acknowledge that the capabilities of such machine-learning inference may not be completely accurate, and more likely will just indicate code that is very likely vulnerable. To make ensure the identified vulnerabilities are real, we propose combining the inference results with fuzzing, a dynamic testing method that searches for inputs that trigger vulnerabilities. Fuzzers are very effective at triggering vulnerabilities, but they have a critical weakness, which is that they must execute the vulnerable code to detect it, and without a guide to where that code might be, they are forced to generate inputs to execute every code path in a program, which is not only inefficient, but often intractable. We propose the development of new targeted fuzzers, which use hints from our machine learning to select sections of code to focus on, thus increasing the efficiency of fuzzing. Triggering the vulnerability gives unequivocal proof that the vulnerability exists, complementing the inherent imprecision of machine learning