| 摘要: |
| 漏洞检测是软件系统安全领域的关键技术. 近年来, 深度学习凭借其代码特征提取的卓越能力, 在漏洞检测领域取得了显著进展. 然而, 当前基于深度学习的方法仅关注于代码实例自身的独立结构特征, 而忽视了不同漏洞代码间存在的结构特征相似关联, 限制了漏洞检测技术的性能. 针对这一问题, 提出了一种基于函数间结构特征关联的软件漏洞检测方法(vulnerability detection method based on correlation of structural features between functions, CSFF-VD). 该方法首先将函数解析为代码属性图, 并通过门控图神经网络提取函数内的独立结构特征. 在此基础之上, 利用特征之间的相似性构建函数间的关联网络并构建基于图注意力网络进一步提取函数间关联信息, 以此提升漏洞检测的性能. 实验结果显示, CSFF-VD在3个公开的漏洞检测数据集上超过了当前基于深度学习的漏洞检测方法. 此外, 在函数内各独立特征提取的基础上, 通过增加CSFF-VD中函数间关联特征提取方法的实验, 证明了集成函数间关联信息的有效性. |
| 关键词: 漏洞检测 代码结构特征 函数关联 图注意力网络 |
| DOI：10.13328/j.cnki.jos.007341 |
| 分类号: |
| 基金项目:国家自然科学基金(62272174); 广东省基础与应用基础研究基金(2022A1515110564); 广州市智慧农业重点实验室项目(201902010081) |
|
| Software Vulnerability Detection Method Based on Correlation of Structural Features Between Functions |
|
QIU Shao-Jian1,2, CHENG Jia-Hao1, HUANG Meng-Yang1, HUANG Qiong1,2
|
|
1.College of Software, South China Agricultural University, Guangzhou 510642, China;2.Guangzhou Key Laboratory of Intelligent Agriculture, Guangzhou 510642, China
|
| Abstract: |
| Vulnerability detection is a critical technology in software system security. In recent years, deep learning has achieved remarkable progress in vulnerability detection due to its outstanding ability in code feature extraction. However, the existing deep learning-based methods only concentrate on the independent structural features of code instances, overlooking the structural feature similarities and correlations among different vulnerable codes, which limits the performance of vulnerability detection technology. To address this issue, this study proposes a vulnerability detection method based on correlation of structural features between functions (CSFF-VD). This method first parses functions into code property graphs and the independent structural features within functions are extracted by using gated graph neural networks. On this foundation, an association network among functions is constructed based on feature similarity, and a graph attention network is utilized to further extract the correlation information between functions, thus improving the performance of vulnerability detection. Experimental results show that CSFF-VD surpasses the current deep learning-based vulnerability detection methods on three public vulnerability detection datasets. In addition, based on the extraction of independent features within the function, this study proves the effectiveness of integrating the correlation information between functions by adding experiments on the inter-function correlation feature extraction method in CSFF-VD. |
| Key words: vulnerability detection code structural feature correlation of function graph attention network |
