| 引用本文: | 曲豫宾,黄松,陈翔,王兴亚,李龙,王丹,姚永明,鞠小林.面向深度漏洞检测模型的黑盒对抗攻击.软件学报,2025,36(11):5062-5081 |
| |
|
| |
|
|
| 本文已被：浏览 1683次 下载 1441次 |
码上扫一扫！ |
|
|
| 面向深度漏洞检测模型的黑盒对抗攻击 |
|
曲豫宾1,2,3, 黄松1, 陈翔4, 王兴亚5, 李龙3, 王丹5, 姚永明1, 鞠小林4
|
|
1.中国人民解放军陆军工程大学 指挥控制工程学院, 江苏 南京 210007;2.江苏工程职业技术学院 信息工程学院, 江苏 南通 226001;3.广西可信软件重点实验室(桂林电子科技大学), 广西 桂林 541004;4.南通大学 信息科学技术学院, 江苏 南通 226019;5.南京工业大学 人工智能学院, 江苏 南京 211816
|
|
| 摘要: |
| 近年来, 基于深度学习的漏洞检测模型展示了令人印象深刻的漏洞检测能力. 通过对源代码的变量重命名实现扰动从而逃逸漏洞检测模型的对抗攻击已被广泛研究, 然而, 能否通过对源代码进行更多的扰动以提升对漏洞检测模型对抗攻击的效果并未被充分调研. 采用针对源代码的多种同义转换算子对其进行扰动, 并提出一种基于遗传算法的组合优化策略, 选择一组适应度最高的源代码同义转换算子, 以指导生成可以逃脱漏洞检测的对抗代码段. 在一个名为NonVulGen (无漏洞代码生成器, non vulnerability generator)的框架中实现了上述方法, 采用生成的对抗代码段对基于深度学习的漏洞检测模型进行评估. 考虑了最新提出的多种深度学习漏洞检测模型, 在攻击基于CodeBERT的漏洞检测模型时所提方法可以实现91.38%的平均攻击成功率, 在攻击基于GraphCodeBERT的漏洞检测模型时可以实现93.65%的平均攻击成功率, 以上结果相较于最先进的基线模型平均提升了28.94%和15.52%. 为了检验所提攻击方法的泛化能力, 攻击Devign、ReGVD和LineVul等常见漏洞检测模型, 平均攻击成功率分别为98.88%、97.85%和92.57%. 实验结果表明, 基于深度学习的漏洞检测模型无法有效区分由NonVulGen生成的对抗代码段. 进一步地, 基于训练数据生成的对抗代码段重训练漏洞检测模型, 在CodeBERT, GraphCodeBERT, Devign, ReGVD以及LineVul模型上攻击成功率均大幅度下降, 分别下降96.83%, 97.12%, 98.79%, 98.57%, 以及97.94%. 因此, 研究揭示基于深度学习漏洞检测模型存在亟待关注的对抗攻击问题并呼吁在发布漏洞检测模型之前做好模型加固工作. |
| 关键词: 漏洞检测 代码转换 深度学习 黑盒鲁棒攻击 |
| DOI：10.13328/j.cnki.jos.007379 |
| 分类号:TP311 |
| 基金项目:国家自然科学基金(U23A20280, 62172350); 广东省基础与应用基础研究基金(2023A1515012846); 广西壮族自治区重点研发计划(2023AB29051); 江苏省“青蓝工程”中青年学术带头人培养项目; 南京大学软件新技术国家重点实验室开放项目(KFKT2022B10); 广西可信软件重点实验室 (kx202046); 南通市自然科学基金面上项目 (JC2023070) |
|
| Black-box Adversarial Attack for Deep Vulnerability Detection Model |
|
QU Yu-Bin1,2,3, HUANG Song1, CHEN Xiang4, WANG Xing-Ya5, LI Long3, WANG Dan5, YAO Yong-Ming1, JU Xiao-Lin4
|
|
1.College of Command and Control Engineering, Army Engineering University of PLA, Nanjing 210007, China;2.School of Information Engineering, Jiangsu College of Engineering and Technology, Nantong 226001, China;3.Guangxi Key Laboratory of Trusted Software (Guilin University of Electronic Technology), Guilin 541004, China;4.School of Information Science and Technology, Nantong University, Nantong 226019, China;5.College of Artificial Intelligence, Nanjing Tech University, Nanjing 211816, China
|
| Abstract: |
| In recent years, impressive capabilities have been demonstrated by deep learning-based vulnerability detection models in detecting vulnerabilities. Previous research has widely explored adversarial attacks using variable renaming to introduce disturbances in source code and evade detection. However, the effectiveness of introducing multiple disturbances through various transformation techniques in source code has not been adequately investigated. In this study, multiple synonymous transformation operators are applied to introduce disturbances in source code. A combination optimization strategy based on genetic algorithms is proposed, enabling the selection of source code transformation operators with the highest fitness to guide the generation of adversarial code segments capable of evading vulnerability detection. The proposed method is implemented in a framework named non-vulnerability generator (NonVulGen) and evaluated against deep learning-based vulnerability detection models. When applied to recently developed deep learning models, an average attack success rate of 91.38% is achieved against the CodeBERT-based model and 93.65% against the GraphCodeBERT-based model, representing improvements of 28.94% and 15.52% over state-of-the-art baselines, respectively. To assess the generalization ability of the proposed attack method, common models including Devign, ReGVD, and LineVul are targeted, achieving average success rates of 98.88%, 97.85%, and 92.57%, respectively. Experimental results indicate that adversarial code segments generated by NonVulGenx cannot be effectively distinguished by deep learning-based vulnerability detection models. Furthermore, significant reductions in attack success rates are observed after retraining the models with adversarial samples generated based on the training data, with a decrease of 96.83% for CodeBERT, 97.12% for GraphCodeBERT, 98.79% for Devign, 98.57% for ReGVD, and 97.94% for LineVul. These findings reveal the critical challenge of adversarial attacks in deep learning-based vulnerability detection models and highlight the necessity for model reinforcement before deployment. |
| Key words: vulnerability detection code transformation deep learning black-box robustness attack |
|
|
|
|
