论文标题
用于检测具有漏洞的代码线的分层深神经网络
A Hierarchical Deep Neural Network for Detecting Lines of Codes with Vulnerabilities
论文作者
论文摘要
由源代码中的无意缺陷引起的软件漏洞是网络攻击的主要根本原因。源代码静态分析已广泛用于检测软件开发人员引入源代码中的无意缺陷，即漏洞。在本文中，我们提出了一种深度学习方法，以根据自然语言处理中使用的技术从其LLVM IR表示中检测脆弱性。所提出的方法使用层次过程首先识别具有漏洞的源代码，然后标识有助于检测到的源代码中漏洞的代码线。该提出的两步方法减少了检测脆弱线路的错误警报。我们对NVD和SARD收集的现实世界和合成代码的广泛实验在检测源代码漏洞中表现出很高的精度（约为98 \％）。
Software vulnerabilities, caused by unintentional flaws in source codes, are the main root cause of cyberattacks. Source code static analysis has been used extensively to detect the unintentional defects, i.e. vulnerabilities, introduced into the source codes by software developers. In this paper, we propose a deep learning approach to detect vulnerabilities from their LLVM IR representations based on the techniques that have been used in natural language processing. The proposed approach uses a hierarchical process to first identify source codes with vulnerabilities, and then it identifies the lines of codes that contribute to the vulnerability within the detected source codes. This proposed two-step approach reduces the false alarm of detecting vulnerable lines. Our extensive experiment on real-world and synthetic codes collected in NVD and SARD shows high accuracy (about 98\%) in detecting source code vulnerabilities.
