AIセキュリティポータル K Program
An Unbiased Transformer Source Code Learning with Semantic Vulnerability Graph
Share
Abstract
Over the years, open-source software systems have become prey to threat actors. Even as open-source communities act quickly to patch the breach, code vulnerability screening should be an integral part of agile software development from the beginning. Unfortunately, current vulnerability screening techniques are ineffective at identifying novel vulnerabilities or providing developers with code vulnerability and classification. Furthermore, the datasets used for vulnerability learning often exhibit distribution shifts from the real-world testing distribution due to novel attack strategies deployed by adversaries and as a result, the machine learning model's performance may be hindered or biased. To address these issues, we propose a joint interpolated multitasked unbiased vulnerability classifier comprising a transformer "RoBERTa" and graph convolution neural network (GCN). We present a training process utilizing a semantic vulnerability graph (SVG) representation from source code, created by integrating edges from a sequential flow, control flow, and data flow, as well as a novel flow dubbed Poacher Flow (PF). Poacher flow edges reduce the gap between dynamic and static program analysis and handle complex long-range dependencies. Moreover, our approach reduces biases of classifiers regarding unbalanced datasets by integrating Focal Loss objective function along with SVG. Remarkably, experimental results show that our classifier outperforms state-of-the-art results on vulnerability detection with fewer false negatives and false positives. After testing our model across multiple datasets, it shows an improvement of at least 2.41% and 18.75% in the best-case scenario. Evaluations using N-day program samples demonstrate that our proposed approach achieves a 93% accuracy and was able to detect 4, zero-day vulnerabilities from popular GitHub repositories.
Cve Common vulnerabilities and exposures
Published: 2018
Less is more: supporting developers in vulnerability detection during code review
Larissa Braz, Christian Aeberhard, Gul Çalikli, Alberto Bacchelli
Published: 2022
Proactive attribute-based secure data schema for mobile cloud in financial industry
Keke Gai, Meikang Qiu, Bhavani Thuraisingham, Lixin Tao
Published: 2015
An investigation on cyber security threats and security models
Kutub Thakur, Meikang Qiu, Keke Gai, Md Liakat Ali
Published: 2015
Devign: Effective Vulnerability Identification by Learning Comprehensive Program Semantics via Graph Neural Networks
Yaqin Zhou, Shangqing Liu, Jingkai Siow, Xiaoning Du, Yang Liu
Published: 9.9.2019
Sysevr: A framework for using deep learning to detect software vulnerabilities
Li, Z., Zou, D., Xu, S., Jin, H., Zhu, Y., Chen, Z.
Published: 2021
A vulnerability detection algorithm based on transformer model
Fujin Hou, Kun Zhou, Longbin Li, Yuan Tian, Jie Li, Jian Li
Published: 2022
Deep learning based vulnerability detection: Are we there yet
Saikat Chakraborty, Rahul Krishna, Yangruibo Ding, Baishakhi Ray
Published: 2021
Survey on deep learning with class imbalance
Justin M Johnson, Taghi M Khoshgoftaar
Published: 2019
Smote: synthetic minority over-sampling technique
N. V. Chawla, K. W. Bowyer, L. O. Hall, W. P. Kegelmeyer
Published: 2002
Wilds: A benchmark of in-the-wild distribution shifts
Pang Wei Koh, Shiori Sagawa, Henrik Marklund, Sang Michael Xie, Marvin Zhang, Akshay Balsubramani, Weihua Hu, Michihiro Yasunaga, Richard Lanas Phillips, Irena Gao
Published: 2021
Vulnerability prediction from source code using machine learning
Zeki Bilgin, Mehmet Akif Ersoy, Elif Ustundag Soykan, Emrah Tomur, Pinar Çomak, Leyli Karaçay
Published: 2020
Modeling and discovering vulnerabilities with code property graphs
F. Yamaguchi, N. Golde, D. Arp, K. Rieck
Published: 2014
Code vulnerability detection based on deep sequence and graph models: A survey
Bolun Wu, Futai Zou, et al.
Published: 2022
Share