These labels were automatically added by AI and may be inaccurate. For details, see About Literature Database.
Abstract
Over the years, open-source software systems have become prey to threat
actors. Even as open-source communities act quickly to patch the breach, code
vulnerability screening should be an integral part of agile software
development from the beginning. Unfortunately, current vulnerability screening
techniques are ineffective at identifying novel vulnerabilities or providing
developers with code vulnerability and classification. Furthermore, the
datasets used for vulnerability learning often exhibit distribution shifts from
the real-world testing distribution due to novel attack strategies deployed by
adversaries and as a result, the machine learning model's performance may be
hindered or biased. To address these issues, we propose a joint interpolated
multitasked unbiased vulnerability classifier comprising a transformer
"RoBERTa" and graph convolution neural network (GCN). We present a training
process utilizing a semantic vulnerability graph (SVG) representation from
source code, created by integrating edges from a sequential flow, control flow,
and data flow, as well as a novel flow dubbed Poacher Flow (PF). Poacher flow
edges reduce the gap between dynamic and static program analysis and handle
complex long-range dependencies. Moreover, our approach reduces biases of
classifiers regarding unbalanced datasets by integrating Focal Loss objective
function along with SVG. Remarkably, experimental results show that our
classifier outperforms state-of-the-art results on vulnerability detection with
fewer false negatives and false positives. After testing our model across
multiple datasets, it shows an improvement of at least 2.41% and 18.75% in the
best-case scenario. Evaluations using N-day program samples demonstrate that
our proposed approach achieves a 93% accuracy and was able to detect 4,
zero-day vulnerabilities from popular GitHub repositories.
IEEE Transactions on Dependable and Secure Computing
Sysevr: A framework for using deep learning to detect software vulnerabilities
Li, Z., Zou, D., Xu, S., Jin, H., Zhu, Y., Chen, Z.
Published: 2021
International Conference on Artificial Intelligence and Security
A vulnerability detection algorithm based on transformer model
Fujin Hou, Kun Zhou, Longbin Li, Yuan Tian, Jie Li, Jian Li
Published: 2022
IEEE Transactions on Software Engineering
Deep learning based vulnerability detection: Are we there yet
Saikat Chakraborty, Rahul Krishna, Yangruibo Ding, Baishakhi Ray
Published: 2021
Journal of Big Data
Survey on deep learning with class imbalance
Justin M Johnson, Taghi M Khoshgoftaar
Published: 2019
J. Artif. Int. Res.
Smote: synthetic minority over-sampling technique
N. V. Chawla, K. W. Bowyer, L. O. Hall, W. P. Kegelmeyer
Published: 2002
International Conference on Machine Learning
Wilds: A benchmark of in-the-wild distribution shifts
Pang Wei Koh, Shiori Sagawa, Henrik Marklund, Sang Michael Xie, Marvin Zhang, Akshay Balsubramani, Weihua Hu, Michihiro Yasunaga, Richard Lanas Phillips, Irena Gao
Published: 2021
IEEE Access
Vulnerability prediction from source code using machine learning