检索结果-内蒙古大学图书馆

software vulnerability detection under poisoning attacks using CNN-based image processing

INTERNATIONAL JOURNAL OF INFORMATION SECURITY 2025年第2期24卷 1-22页

作者： Gonzalez-Manzano, Lorena Garcia-Alfaro, Joaquin Univ Carlos III Madrid Leganes Spain Inst Polytech Paris SAMOVAR Telecom SudParis F-91120 Palaiseau France

Design flows, code errors, or inadequate countermeasures may occur in software development. Some of them lead to vulnerabilities in the code, opening the door to attacks. Assorted techniques are developed to detect vulnerable code samples, making artificial intelligence techniques, such as Machine Learning (ML), a common practice. Nonetheless, the security of ML is a major concern. This includes the the case of ML-based detection whose training process is affected by data poisoning. More generally, vulnerability detection can be evaded unless poisoning attacks are properly handled. This paper tackles this problem. A novel vulnerability detection system based on ML-based image processing, using Convolutional Neural Network (CNN), is proposed. The system, hereinafter called IVul, is evaluated under the presence of backdoor attacks, a precise type of poisoning in which a pattern is introduced in the training data to alter the expected behavior of the learned models. IVul is evaluated with more than three thousand code samples associated with two representative programming languages (C# and PHP). IVul outperforms other comparable state-of-the-art vulnerability detectors in the literature, reaching 82%\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$82\%$$\end{document} to 99%\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$99\%$$\end{document} detection accuracy. Besides, results show that the type of attack may affect a particular language more than another, though, in general, PHP is more resilient to proposed attacks than C#.

关键词： software vulnerability detection Poisoning attack Artificial Intelligence Machine learning Convolutional neural networks

来源：评论

学校读者我要写书评

暂无评论

A Systematic Literature Review on Automated software vulnerability detection Using Machine Learning

引用

ACM COMPUTING SURVEYS 2025年第3期57卷 1-36页

作者： Harzevili, Nima shiri Belle, Alvine boaye Wang, Junjie Wang, Song Jiang, Zhen ming (jack) Nagappan, Nachiappan York Univ Elect Engn & Comp Sci Keele Campus Toronto ON Canada York Univ Elect Engn & Comp Sci Toronto ON Canada Chinese Acad Sci Inst Software Beijing Peoples R China Meta Seattle WA USA

In recent years, numerous Machine Learning (ML) models, including Deep Learning (DL) and classic ML models, have been developed to detect software vulnerabilities. However, there is a notable lack of comprehensive and systematic surveys that summarize, classify, and analyze the applications of these ML models in software vulnerability detection. This absence may lead to critical research areas being overlooked or underrepresented, resulting in a skewed understanding of the current state of the art in software vulnerability detection. To close this gap, we propose a comprehensive and systematic literature review that characterizes the different properties of ML-based software vulnerability detection systems using six major Research Questions (RQs). Using a custom web scraper, our systematic approach involves extracting a set of studies from four widely used online digital libraries: ACM Digital Library, IEEE Xplore, ScienceDirect, and Google Scholar. We manually analyzed the extracted studies to filter out irrelevant work unrelated to software vulnerability detection, followed by creating taxonomies and addressing RQs. Our analysis indicates a significant upward trend in applying ML techniques for software vulnerability detection over the past few years, with many studies published in recent years. Prominent conference venues include the International Conference on software Engineering (ICSE), the International Symposium on software Reliability Engineering (ISSRE), the Mining software Repositories (MSR) conference, and the ACM International Conference on the Foundations of software Engineering (FSE), whereas Information and software Technology (IST), Computers & Security (C&S), and Journal of Systems and software (JSS) are the leading journal venues. Our results reveal that 39.1% of the subject studies use hybrid sources, whereas 37.6% of the subject studies utilize benchmark data for software vulnerability detection. Code-based data are the most commonly used data t

关键词： Source code software security software vulnerability detection software bug detection machine learning deep learning

来源：评论

学校读者我要写书评

暂无评论

Large language models for software vulnerability detection: a guide for researchers on models, methods, techniques, datasets, and metrics

引用

INTERNATIONAL JOURNAL OF INFORMATION SECURITY 2025年第2期24卷 1-66页

作者： Far, Seyed Mohammad Taghavi Feyzi, Farid Univ Guilan Comp Engn Rasht Iran

Large language models (LLMs) have emerged as transformative tools in the domain of software vulnerability detection and management, offering sophisticated capabilities in identifying, analyzing, and mitigating security risks. This article delves into the utilization of LLMs, examining their role in revolutionizing traditional approaches to software vulnerability detection. We explore the various categories of LLMs, such as bidirectional encoder representations from transformers (BERT) and generative pre-trained transformer (GPT), and how these models are being leveraged to improve the accuracy and efficiency of vulnerability detection. This article reviews how LLMs are being integrated into existing software security frameworks, synthesizing research findings on their performance in various contexts. It includes insights into how LLM-based methods complement traditional techniques like static analysis and fuzz testing, without engaging in a direct comparative analysis of these approaches. The comparison highlights the strengths of LLMs, such as their ability to generalize across diverse codebases and programming languages, while also addressing their limitations, such as susceptibility to biases from training data and the hallucination. The article synthesizes findings from recent research, showcasing how LLMs have been successfully employed to detect a range of vulnerabilities, from buffer overflows to SQL injections, and outlines how these models enhance productivity by automating the detection and reporting of security flaws. Additionally, we discuss the inherent challenges in applying LLMs to software vulnerability detection, such as the need for high-quality datasets, and the ethical implications related to the deployment of LLM-based systems in security-critical applications. Addressing these challenges is crucial for the future advancement of LLM technologies in the cybersecurity domain. A comprehensive introduction to foundational and specialized datasets is

关键词： Security and privacy software and application security software security engineering Computing methodologies Machine learning Machine learning approaches Large language models (LLMs) software vulnerabilities software vulnerability detection software vulnerability datasets vulnerability detection metrics Fine-tuning techniques

来源：评论

学校读者我要写书评

暂无评论

Defect-scanner: a comparative empirical study on language model and deep learning approach for software vulnerability detection

引用

INTERNATIONAL JOURNAL OF INFORMATION SECURITY 2024年第6期23卷 3513-3526页

作者： Pham, Van-Hau Hien, Do Thi Thu Hoang, Hien Do Duy, Phan The Univ Informat Technol Informat Secur Lab Ho Chi Minh City Vietnam Vietnam Natl Univ Ho Chi Minh City Vietnam

The complex and rapidly evolving nature of modern software landscapes introduces challenges such as increasingly sophisticated cyber threats, the diversity in programming languages and coding styles, and the need to identify subtle patterns indicative of vulnerabilities. These hurdles underscore the necessity for advanced techniques that can effectively cope with the intricacies of software security. Hence, this paper gives a comparative empirical study in harnessing the potential of cutting-edge natural language processing (NLP) advancements, namely Word2Vec and CodeBERT to detect vulnerabilities in C and C++ programs in the proposed Defect-Scanner framework. With the capability of converting code components and source code into contextual embedding vectors, various potential NLP techniques are combined with several DL models to evaluate the precision and accuracy of identifying vulnerabilities within software systems. Moreover, the experimentations are conducted using datasets with different representation types of codes, aiming to figure out the best combination of NLP techniques and DL models to work with each form of input. As a result, besides the outperformance of CodeBERT-based models with accuracies of approximately 90%, this comparative study also provides a comprehensive evaluation of NLP-based software vulnerability detection in the face of intricate security challenges.

关键词： software vulnerability detection Deep Learning Natural Language Processing Language Model CodeBERT.

来源：评论

学校读者我要写书评

暂无评论

Exploring Semantic Redundancy using Backdoor Triggers: A Complementary Insight into the Challenges Facing DNN-based software vulnerability detection

引用

ACM TRANSACTIONS ON software ENGINEERING AND METHODOLOGY 2024年第4期33卷 1-28页

作者： Shao, Changjie Li, Gaolei Wu, Jun Zheng, Xi Shanghai Jiao Tong Univ 800 Dongchuan Rd Shanghai 200240 Peoples R China Waseda Univ 2-7 HibikinoWakamatsu Ku Kitakyushu Fukuoka 8080135 Japan Macquarie Univ 4 Res Pk Dr Sydney NSW 2113 Australia Univ Calif Los Angeles Los Angeles CA USA

To detect software vulnerabilities with better performance, deep neural networks (DNNs) have received extensive attention recently. However, these vulnerability detection DNN models trained with code representations are vulnerable to specific perturbations on code representations. This motivates us to rethink the bane of software vulnerability detection and find function-agnostic features during code representation which we name as semantic redundant features. This paper first identifies a tight correlation between function-agnostic triggers and semantic redundant feature space (where the redundant features reside) in these DNN models. For correlation identification, we propose a novel Backdoor-based Semantic Redundancy Exploration (BSemRE) framework. In BSemRE, the sensitivity of the trained models to function-agnostic triggers is observed to verify the existence of semantic redundancy in various code representations. Specifically, acting as the typical manifestations of semantic redundancy, naming conventions, ternary operators and identically-true conditions are exploited to generate function-agnostic triggers. Extensive comparative experiments on 1,613,823 samples of eight representative vulnerability datasets and state-of-the-art code representation techniques and vulnerability detection models demonstrate that the existence of semantic redundancy determines the upper trustworthiness limit of DNN-based software vulnerability detection. To the best of our knowledge, this is the first work exploring the bane of software vulnerability detection using backdoor triggers.

关键词： software vulnerability detection deep neural networks backdoor triggers semantic redundancy function-agnostic

来源：评论

学校读者我要写书评

暂无评论

A comprehensive analysis on software vulnerability detection datasets: trends, challenges, and road ahead

引用

INTERNATIONAL JOURNAL OF INFORMATION SECURITY 2024年第5期23卷 3311-3327页

作者： Guo, Yuejun Bettaieb, Seifeddine Casino, Fran Luxembourg Inst Sci & Technol LIST 5 Ave Hauts Fourneaux Esch Belval Luxembourg Rovira & Virgili Univ Dept Comp Engn & Math Tarragona Spain Athena Res Ctr Informat Management Syst Inst Artemidos 6 Maroussi Greece

As society's dependence on information and communication systems (ICTs) grows, so does the necessity of guaranteeing the proper functioning and use of such systems. In this context, it is critical to enhance the security and robustness of the DevSecOps pipeline through timely vulnerability detection. Usually, AI-based models enable desirable features such as automation, performance, and efficacy. However, the quality of such models highly depends on the datasets used during the training stage. The latter encompasses a series of challenges yet to be solved, such as access to extensive labelled datasets with specific properties, such as well-represented and balanced samples. This article explores the current state of practice of software vulnerability datasets and provides a classification of the main challenges and issues. After an extensive analysis, it describes a set of guidelines and desirable features that datasets should guarantee. The latter is applied to create a new dataset, which fulfils these properties, along with a descriptive comparison with the state of the art. Finally, a discussion on how to foster good practices among researchers and practitioners sets the ground for further research and continued improvement within this critical domain.

关键词： software vulnerability detection Benchmarking Datasets DevSecOps

来源：评论

学校读者我要写书评

暂无评论

Optimizing software vulnerability detection using RoBERTa and machine learning

引用

AUTOMATED software ENGINEERING 2024年第2期31卷 40-40页

作者： Do, Cho Xuan Luu, Nguyen Trong Nguyen, Phuong Thi Lan Posts & Telecommun Inst Technol Fac Informat Secur Hanoi Vietnam Posts & Telecommun Inst Technol Fac Informat Technol Hanoi Vietnam

Detecting vulnerabilities in source code written in C and C + + is currently essential as attack techniques against systems seek to find, exploit, and attack these vulnerabilities. In this article, to improve the effectiveness of the source code vulnerability detection process, we propose a new approach based on building and representing source code features using natural language processing (NLP) techniques. Our proposal in the article consists of two main stages: (i) building a feature profile of the source code using the RoBERTa model, and (ii) classifying source code based on the feature profile using a supervised machine learning algorithm. Specifically, with our proposal utilizing the pre-trained RoBERTa model, we have successfully built and represented important features of source code as complete vectors, thereby enhancing the effectiveness of prediction and vulnerability detection models. The experimental part of our article compared and evaluated our proposal with other approaches on the FFmpeg + Qume dataset. The experimental results in the article showed that the approach in this study was superior to other research directions on all measures. Therefore, the proposal to use NLP techniques based on the RoBERTa model not only has scientific significance as a new research direction that has not been proposed for application but also has practical significance when all experimental results are highly effective.

关键词： Source code vulnerability software vulnerability detection RoBERTa Machine learning algorithms Natural language processing

来源：评论

学校读者我要写书评

暂无评论

A deep learning-based approach for software vulnerability detection using code metrics

引用

IET software 2022年第5期16卷 516-526页

作者： Subhan, Fazli Wu, Xiaoxue Bo, Lili Sun, Xiaobing Rahman, Muhammad Yangzhou Univ Jiangsu Coll Informat Engn Yangzhou 225000 Jiangsu Peoples R China

Vulnerabilities can have devastating effects on information security, affecting the economy, social stability, and national security. The idea of automatic vulnerability detection has always attracted researchers. From traditional manual vulnerability mining techniques to static and dynamic detection, all rely on human experts for feature definition. The rapid development of machine learning and deep learning has alleviated the tedious task of manually defining features by human experts while reducing the lack of objectivity caused by human subjective awareness. However, it is still necessary to find an objective characterisation method to define the features of vulnerabilities. Therefore, the authors use code metrics for code characterisation, sequences of metrics representing code. To use code metrics for vulnerability detection, a deep learning-based vulnerability detection approach that uses a composite neural network of convolutional neural network (CNN) with long short-term memory (LSTM) is proposed. The authors conduct experiments independently using the proposed approach for CNN-LSTM CNN, LSTM, gated recurrent units (GRU), and deep neural network (DNN). The authors' experimental results show that CNN-LSTM has a high precision of 92%, a recall of 99%, and an accuracy of 91%. In terms of the F1-score, it is 95%, compared to previous research results, which indicated an improvement of 18%. Compared to other deep learning-based vulnerability detection models, the authors' proposed model produced a lower false-positive rate, a lower miss rate, and improved accuracy.

关键词： static detection information security software vulnerability detection deep learning (artificial intelligence) objective characterisation method dynamic detection national security automatic vulnerability detection security of data machine learning mining techniques human experts deep learning-based vulnerability detection models convolutional neural nets recurrent neural nets code characterisation code metrics gated recurrent units social stability CNN-LSTM CNN data mining convolutional neural network human subjective awareness composite neural network deep neural network feature definition

来源：评论

学校读者我要写书评

暂无评论

SwordDTA： A Dynamic Taint Analysis Tool for software vulnerability detection

引用

Wuhan University Journal of Natural Sciences 2016年第1期21卷 10-20页

作者： CAI Jun ZOU Peng MA Jinxin HE Jun Science and Technology on Complex Electronic System Simulation Laboratory Academy of Equipment Beijing 101416China China Information Technology Security Evaluation Center Beijing 100085 China

software vulnerabilities are the root cause of various information security incidents while dynamic taint analysis is an emerging program analysis technique. In this paper, to maximize the use of the technique to detect software vulnerabilities, we present SwordDTA, a tool that can perform dynamic taint analysis for binaries. This tool is flexible and extensible that it can work with commodity software and hardware. It can be used to detect software vulnerabilities with vulnerability modeling and taint check. We evaluate it with a number of commonly used real-world applications. The experimental results show that SwordDTA is capable of detecting at least four kinds of softavare vulnerabilities including buffer overflow, integer overflow, division by zero and use-after-free, and is applicable for a wide range of software.

关键词： information security software vulnerability detection dynamic taint analysis use-after-free

来源：评论

学校读者我要写书评

暂无评论

Transformer-Based Language Models for software vulnerability detection 22

Transformer-Based Language Models for Software Vulnerability...

引用

38th Annual Computer Security Applications Conference (ACSAC)

作者： Thapa, Chandra Jang, Seung Ick Ahmed, Muhammad Ejaz Camtepe, Seyit Pieprzyk, Josef Nepal, Surya CSIROs Data61 Marsfield NSW Australia

ISBN: (纸本)9781450397599

The large transformer-based language models demonstrate excellent performance in natural language processing. By considering the transferability of the knowledge gained by these models in one domain to other related domains, and the closeness of natural languages to high-level programming languages, such as C/C++, this work studies how to leverage (large) transformer-based language models in detecting software vulnerabilities and how good are these models for vulnerability detection tasks. In this regard, firstly, we present a systematic (cohesive) framework that details source code translation, model preparation, and inference. Then, we perform an empirical analysis of software vulnerability datasets of C/C++ source codes having multiple vulnerabilities corresponding to the library function call, pointer usage, array usage, and arithmetic expression. Our empirical results demonstrate the good performance of the language models in vulnerability detection. Moreover, these language models have better performance metrics, such as F1-score, than the contemporary models, namely bidirectional long short term memory and bidirectional gated recurrent unit. Experimenting with the language models is always challenging due to the requirement of computing resources, platforms, libraries, and dependencies. Thus, this paper also analyses the popular platforms to efficiently fine-tune these models and present recommendations while choosing the platforms for our framework.

关键词： software vulnerability detection transformer-based models BERT GPT-2

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：