检索结果-内蒙古大学图书馆

Detecting malicious JavaScript code based on semantic analysis

COMPUTERS & SECURITY 2020年 93卷 101764-101764页

作者： Fang, Yong Huang, Cheng Su, Yu Qiu, Yaoyao Sichuan Univ Coll Cybersecur Chengdu Peoples R China Sichuan Univ Coll Elect & Informat Engn Chengdu Peoples R China

Web development technology has undergone tremendous evolution, the creation of JavaScript has greatly enriched the interactive capabilities of the client. However, attackers use the dynamics feature of JavaScript language to embed malicious code into web pages for the purpose of drive-by-download, redirection, etc. The traditional method based on static feature detection is difficult to detect the malicious code after obfuscation, and the method based on dynamic analysis has low efficiency. To overcome these challenges, this paper proposes a static detection model based on semantic analysis. The model firstly generates an abstract syntax tree from JavaScript source codes, then automatically converts them to syntactic unit sequences. FastText algorithm is introduced to training word vectors. The syntactic unit sequences are represented as word vectors which will be input into Bi-LSTM network with attention mechanism. The detection model with Bi-LSTM network with attention mechanism is the key to detect malicious JavaScript. We experimented with the dataset using a five-fold cross-validation method. Experiments showed that the model can effectively detect obfuscated malicious JavaScript code and improve the detection speed, with a precision of 0.977 and recall of 0.974. (C) 2020 Elsevier Ltd. All rights reserved.

关键词： Malicious JavaScript detection abstract syntax tree Attention mechanism Static analysis Bi-LSTM FastText

来源：评论

学校读者我要写书评

暂无评论

An Empirical Case Study on the Temporary File Smell in Dockerfiles

引用

IEEE ACCESS 2019年 7卷 63650-63659页

作者： Lu, Zhigang Xu, Jiwei Wu, Yuewen Wang, Tao Huang, Tao Chinese Acad Sci Inst Software Beijing Peoples R China Univ Chinese Acad Sci Beijing Peoples R China Univ Coll Dublin Sch Comp Sci Dublin Ireland

Docker is widely used in data centers to host services. The docker image adopts a hierarchical storage architecture, which means that the docker image is composed of a set of filesystem layers. In the image building process, only the top layer is read-write, while the bottom layers are all read-only. However, temporary files are often used in the image building process. Nevertheless, if a temporary file is imported and removed in different layers by a careless developer, it will lead a file redundancy. We termed this problem "temporary file smell." This smell leads to larger-size images, which seriously restricts the efficiency of image distribution and thus affects the scaling ability of services in facing of sudden high load. To address this problem, we make an empirical case study to the real-world Dockerfiles on DockerHub. Based on the case study, we summarize four different smell patterns and propose a state-depend static analysis method to detect this kind of smells. We also provide three feasible fixing methods as selective options to eliminate the temporary file smell.

关键词： abstract syntax tree Docker Dockerfile static analysis temporary file smell

来源：评论

学校读者我要写书评

暂无评论

V2Va+: An Efficient SystemVerilog & Verilog-to-Verilog-A Translator for Accelerated Mixed-Signal Simulation

IEEE OPEN JOURNAL OF CIRCUITS AND SYSTEMS

引用

IEEE OPEN JOURNAL OF CIRCUITS AND SYSTEMS 2024年 5卷 387-397页

作者： Wang, Chao Shao, Yicong Huang, Jiajie Lu, Wangzilu Gu, Zhiwen Li, Longfan Zhang, Yuhang Zhao, Jian Mao, Wei Li, Yongfu Shanghai Jiao Tong Univ Dept Micronano Elect Shanghai 200240 Peoples R China Shanghai Jiao Tong Univ MoE Key Lab Artificial Intelligence Shanghai 200240 Peoples R China Xidian Univ Hangzhou Inst Technol Hangzhou 311231 Peoples R China

This paper introduces a streamlined SystemVerilog & Verilog-to-Verilog-A (V2Va +) translation tool that automates the conversion of synthesizable SystemVerilog and Verilog code into Verilog-A code, enabling concurrent simulation of analog and digital circuits. Through a set of mapping rules, V2Va + facilitates mixed-signal simulations in an analog environment, negating the requirement for a separate mixed-signal simulation engine and overcoming multiple types of EDA licensing obstacles. The V2Va + translation tool comprises two integral components: a parser function, tasked with extracting information from SystemVerilog and Verilog files, and a Verilog-A generator, responsible for generating corresponding Verilog-A code. V2Va + excels in handling complexity, ensuring accuracy, and improving efficiency. It effectively manages a wide range of design complexities, maintains functional consistency during translation, and significantly reduces simulation time, achieving speed-ups of over 2x. These strengths underscore its significant impact and applicability in the domain of circuit design.

关键词： Translation Codes Runtime Design methodology Syntactics Generators Complexity theory Hardware design languages Engines Digital circuits Verilog-A Verilog SystemVerilog mixed-signal simulation abstract syntax tree translator

来源：评论

学校读者我要写书评

暂无评论

CoSMSOL:Complex system modeling,simulation and optimization language

引用

International Journal of Modeling, Simulation, and Scientific Computing 2017年第2期8卷 103-123页

作者： Bo Hu Li Xiao Song Lin Zhang Jing Liu Peng Chi Tingyu Lin Xing Zhang Yuanjun Laili Fei Tao Tan Li School of Automation Science and Electrical Engineering Beihang University P.R.China Beijing Simulation Center 50 Yongding Lu Beijing Beijing 100854P.R.China Beijing Institute of Near Space Flight Vehicle Systems Engineering Beijing P.R.China

Complex System Modeling,Simulation and Optimization Language(CoSMSOL)is problem-oriented and designed to run on multi-core *** paper provides the system environment of CoSMSOL and proposes the modeling methods of complex system,language text specification,function library,algorithm library,parallel simulation algorithms and intelligent optimization algorithms which support continuous system,discrete system and agent ***,we developed a simulation language compiler of CoSMSOL,which is employed in two case studies generating a multi-entity war gaming system and an aerodynamic spacecraft *** two cases illustrate main functions and implementation processes of *** results validate that CoSMSOL is useful to model agent-based system and aerospace system.

关键词： Simulation language compiler Backus normal form abstract syntax tree

来源：评论

学校读者我要写书评

暂无评论

Learning to Detect Memory-related Vulnerabilities

引用

ACM TRANSACTIONS ON SOFTWARE ENGINEERING AND METHODOLOGY 2024年第2期33卷 1-35页

作者： Cao, Sicong Sun, Xiaobing Bo, Lili Wu, Rongxin Li, Bin Wu, Xiaoxue Tao, Chuanqi Zhang, Tao Liu, Wei Yangzhou Univ Sch Informat Engn 196 Huayang West Rd Yangzhou 225009 Jiangsu Peoples R China Xiamen Univ Sch Informat 422 Siming South Rd Xiamen 361005 Peoples R China Nanjing Univ Aeronaut & Astronaut Coll Comp Sci & Technol Coll Artificial Intelligence 29 Jiangjun Rd Nanjing 211106 Peoples R China Macau Univ Sci & Technol Sch Comp Sci & Engn Ave Wai Long Macau 999078 Peoples R China

Memory-related vulnerabilities can result in performance degradation or even program crashes, constituting severe threats to the security of modern software. Despite the promising results of deep learning (DL)-based vulnerability detectors, there exist three main limitations: (1) rich contextual program semantics related to vulnerabilities have not yet been fully modeled;(2) multi-granularity vulnerability features in hierarchical code structure are still hard to be captured;and (3) heterogeneous flow information is not well utilized. To address these limitations, in this article, we propose a novel DL-based approach, called MVD+, to detect memory-related vulnerabilities at the statement-level. Specifically, it conducts both intraprocedural and interprocedural analysis to model vulnerability features, and adopts a hierarchical representation learning strategy, which performs syntax-aware neural embedding within statements and captures structured context information across statements based on a novel Flow-Sensitive Graph Neural Networks, to learn both syntactic and semantic features of vulnerable code. To demonstrate the performance, we conducted extensive experiments against eight state-of-the-art DL-based approaches as well as five well-known static analyzers on our constructed dataset with 6,879 vulnerabilities in 12 popular C/C++ applications. The experimental results confirmed that MVD+ can significantly outperform current state-of-the-art baselines and make a great trade-off between effectiveness and efficiency.

关键词： Statement-level vulnerability detection abstract syntax tree graph neural networks flow analysis

来源：评论

学校读者我要写书评

暂无评论

A Suitable AST Node Granularity and Multi-Kernel Transfer Convolutional Neural Network for Cross-Project Defect Prediction

引用

IEEE ACCESS 2020年 8卷 66647-66661页

作者： Deng, Jiehan Lu, Lu Qiu, Shaojian Ou, Yangpeng South China Univ Technol Sch Comp Sci & Engn Guangzhou 510800 Peoples R China South China Univ Technol Modern Ind Technol Res Inst Zhongshan 528400 Peoples R China South China Agr Univ Coll Math & Informat Guangzhou 510642 Peoples R China

Cross-project defect prediction (CPDP) is a feasible way to perform software defect prediction (SDP) when lacking historical data. Recent CPDP approaches have employed deep learning techniques to better exploit the information from the program's abstract syntax trees (ASTs). However, the granularity of the AST nodes and the data distribution difference between projects may have negative impacts on the prediction performance, which many CPDP studies didn't take into consideration. To handle these issues, this paper explores a better AST node granularity and proposes a CPDP framework based on multi-kernel transfer convolutional neural networks. Specifically, for AST node granularity, we explore the difference of three AST node granularities and then compare the prediction performance of each granularity on several prediction models. For the CPDP framework, we first parse the program source code into ASTs and then encode the AST nodes into numerical vectors using the embedding technique. Secondly, to mine transferable semantic features, the encoded ASTs are fed into a convolutional neural network, in which a multi-kernel matching layer is added to minimize the data distribution divergence between the source and target project. Finally, to make use of the information from the handcrafted features, the semantic features mined from the AST are joint with handcrafted features to form the joint features for CPDP. We evaluate our approach on 110 CPDP tasks formed by 11 open-source projects and results show that the proposed CPDP method outperforms most deep learning-based approaches.

关键词： Feature extraction Semantics Software Task analysis Machine learning Convolutional neural networks Syntactics abstract syntax tree cross-project defect prediction maximum mean discrepancy multi-kernel transfer learning

来源：评论

学校读者我要写书评

暂无评论

Three Approaches for Detecting Direct Output Cheating in Program Online Judge Systems

引用

INTERNATIONAL JOURNAL OF SOFTWARE ENGINEERING AND KNOWLEDGE ENGINEERING 2023年第4期33卷 461-486页

作者： Qiu, Jing Shi, Chunmei Lv, Yuehua Zhejiang A&F Univ Coll Math & Comp Sci Hangzhou 311300 Peoples R China Inst Sci & Tech Informat Zhejiang Prov Hangzhou 311300 Peoples R China

Program online judge (POJ) systems allow students to view questions, submit solution code, and receive scores automatically via the web. Most POJs use test cases for scoring. When a POJ is scored by test case pass rate or a problem that has only one test case, students can usually score by providing the direct output of the test cases (direct output cheating). Currently, there is only one work on detecting such cheating. However, its precision is very low. To solve this problem, three novel approaches are proposed to detect direct output cheating: (i) Line Statistics, which computes the proportion of output calls against other statements;(ii) the control degrees ow graph (CFG) Search computes the maximum similarity between the CFG of a program and that of known samples;(iii) abstract syntax tree (AST) Search identifies cheating by matching rules that are summarized from ASTs of previously detected cheating attempts. A student's code is marked as cheating if the similarity exceeds a predefined threshold;and a program is detected as cheating if the proportion exceeds a predefined threshold. The proposed approaches and three well-known code plagiarism detection tools (JPlag, Sherlock, and SIM) were evaluated using 100,000 submissions for 1153 problems from a POJ based on the C programming language. The F1 scores of these approaches were determined as 0.9752 (AST Search), 0.9440 (CFG Search), 0.7405 (Line Statistics), 0.6446 (JPlag), 0.1587 (Sherlock), and 0.0076 (SIM), respectively. The result indicates that (i) AST Search is most suitable for the detection of direct output cheating;(ii) traditional code search or plagiarism detection methods based on similarity calculations are not effective for complex cheat detection because these cheats are highly similar to normal code.

关键词： Direct output cheating cheating detection abstract syntax tree program online judge system online education

来源：评论

学校读者我要写书评

暂无评论

Automated Visualization of Program Architecture Components for the Swift Language

引用

CYBERNETICS AND SYSTEMS ANALYSIS 2024年第6期60卷 1009-1016页

作者： Frankiv, O. Glybovets, M. Natl Univ Kyiv Mohyla Acad Kyiv Ukraine

A model of the architecture of a software module for automated visualization is described. The model contains information about the structural components of the program and the connections between them. The proposed software complex for the automatic construction of program models written in Swift is characterized. A method for using this model to detect design flows has been demonstrated with an example.

关键词： programming software module software architecture software quality assessment architecture visualization automated static analysis design patterns metrics abstract syntax tree

来源：评论

学校读者我要写书评

暂无评论

GNet4FL: effective fault localization via graph convolutional neural network

引用

AUTOMATED SOFTWARE ENGINEERING 2023年第2期30卷 1-26页

作者： Qian, Jie Ju, Xiaolin Chen, Xiang Nantong Univ Sch Informat Sci & Technol Nantong 226019 Jiangsu Peoples R China

Fault localization aims to efficiently locate faults when debugging programs, reducing software development and maintenance costs. Spectrum-based fault location (SBFL) is the most commonly used fault location technology, which calculates and ranks the suspicious value of each program entity with a specific formula by counting the coverage information of all the program entities and execution results of test cases. However, previous SBFL techniques suffered from low accuracy due to the sole use of execution coverage. This paper proposed an approach GNet4FL based on the graph convolutional neural network. GNet4FL first collects static features based on code structure and dynamic features based on test results. Then, GNet4FL uses GraphSAGE to obtain node representation of source codes and performs feature fusion on an entity consisting of multiple nodes, which preserves the topological information of the graph. Finally, the representation of each entity is input to the multi-layer perceptron for training and ranking entities. The results of the study showed that GNet4FL successfully located 160 out of 262 faults, outperforming the three state-of-the-art methods by 94, 42, and 14% in Top-1 accuracy, and having close results to Grace with less cost. Furthermore, we investigated the impact of each component (i.e., graph neural network, pruning, and dynamic features) of GNet4FL on the results. We found that all of these components had a positive impact on the proposed approach.

关键词： Fault localization Graph convolutional neural network abstract syntax tree

来源：评论

学校读者我要写书评

暂无评论

Data-Driven Feedback Generator for Online Programing Courses 17

Data-Driven Feedback Generator for Online Programing Courses

引用

4th Annual ACM Conference on Learning at Scale (L at S)

作者： Wang, Ke Lin, Benjamin Rettig, Bjorn Pardi, Paul Singh, Rishabh Univ Calif Davis Davis CA 95616 USA Microsoft Redmond WA USA

ISBN: (纸本)9781450344500

Manually providing feedback for programming assignments is a tedious task in traditional classroom education. The challenge increases drastically in Massive open online courses (MOOCs), where the student-teacher ratio can reach thousands to one or even millions to one. Despite the necessity, the current automated feedback approaches suffer from significant weaknesses: inability to scale to larger programs, manual involvement of teacher effort, and lack of precision for pinpointing errors. We present a technique to tackle these challenges by developing a data-driven automated grader, iGrader, capable of generating instant and precise feedback for programming assignments.

关键词： automated program repair control flow matching c# massive open online courses abstract syntax tree education edx

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：