A Machine Learning Approach to Detecting Security Vulnerabilities in Software.

本提案旨在探索一种利用程序分析、动态测试生成和机器学习的新组合来检测软件漏洞的新方法。目前，检测软件漏洞最可靠的方法之一是源代码审计，即开发人员手动检查程序的源代码以查看是否存在漏洞。不幸的是，软件系统很大，通常包含数千万行代码，这使得通过手动代码审计来保护所有软件成为不可能的任务。在本提案中，我们探索了一种更好的检测软件漏洞的方法——通过开发识别软件漏洞的机器学习方法。******使机器学习胜过现有漏洞检测工具的关键是要认识到，在代码结构中，以及在变量和函数的名称中，存在一些常见的编程模式，这些模式可以指示漏洞的存在，但没有明确的规范。当前试图机械化扫描代码以查找漏洞的解决方案都只依赖于编程语言或应用程序二进制接口（ABI）显式指定的内容，而不考虑这些隐式代码模式。有些工具确实允许人工手动指定漏洞模式来克服这一限制，但是漏洞模式的巨大变化意味着即使使用这些规范，许多漏洞也会被自动漏洞检测工具遗漏。该提案中关键的新颖方法是使用机器学习来自动学习和利用嵌入在代码结构和变量名称中的编程模式，这些模式表明存在漏洞，并使用它来高精度地自动检测软件中的漏洞。******我们承认，这种机器学习推理的能力可能不是完全准确的，更有可能只是指出非常容易受到攻击的代码。为了确保识别出的漏洞是真实的，我们提出将推理结果与模糊测试相结合，模糊测试是一种动态测试方法，用于搜索触发漏洞的输入。Fuzzers在触发漏洞方面非常有效，但他们有一个严重的弱点，那就是他们必须执行易受攻击的代码来检测它，并且没有指导代码可能在哪里，他们被迫生成输入来执行程序中的每个代码路径，这不仅效率低下，而且通常难以处理。我们建议开发新的目标模糊器，它使用我们的机器学习提示来选择要关注的代码部分，从而提高模糊测试的效率。触发漏洞提供了漏洞存在的明确证据，补充了机器学习固有的不精确性

This proposal aims to explore a new way of detecting software vulnerabilities using a novel combination of program analysis, dynamic test generation and machine learning. Currently, one of the most reliable methods for detecting software vulnerabilities is source code audits, where a developer manually inspects the source code of a program to see if vulnerabilities are present. Unfortunately, software systems are large, commonly containing tens of millions of lines of code, making it an impossible task to secure all software through manual code audits. In this proposal, we explore a better way to detect software vulnerabilities--by developing machine learning methods that will identify software vulnerabilities.******The key to enabling machine learning to outperform existing vulnerability detection tools is to recognize that there are common programming patterns, embedded in the structure of code, as well as in the names of variables and functions, that can indicate the presence of a vulnerability, but for which there exists no explicit specification. Current solutions that try to mechanize the scanning of code for vulnerabilities all rely only on what is explicitly specified by the programming language or application binary interface (ABI), and do not take these implicit code patterns into account. Some tools do allow a human to hand-specify vulnerability patterns to overcome this limitation, but the huge variation in vulnerability patterns means that even with these specifications, many vulnerabilities will be missed by automated vulnerability detection tools. The key novel approach in this proposal is to use machine learning to automatically learn and utilize programming patterns, embedded in code structure and variable names, that indicate the presence of a vulnerability and use this to automatically detect vulnerabilities in software with high accuracy.******We acknowledge that the capabilities of such machine-learning inference may not be completely accurate, and more likely will just indicate code that is very likely vulnerable. To make ensure the identified vulnerabilities are real, we propose combining the inference results with fuzzing, a dynamic testing method that searches for inputs that trigger vulnerabilities. Fuzzers are very effective at triggering vulnerabilities, but they have a critical weakness, which is that they must execute the vulnerable code to detect it, and without a guide to where that code might be, they are forced to generate inputs to execute every code path in a program, which is not only inefficient, but often intractable. We propose the development of new targeted fuzzers, which use hints from our machine learning to select sections of code to focus on, thus increasing the efficiency of fuzzing. Triggering the vulnerability gives unequivocal proof that the vulnerability exists, complementing the inherent imprecision of machine learning