检索结果-内蒙古大学图书馆

Android source code vulnerability Detection: A Systematic Literature Review

ACM COMPUTING SURVEYS 2023年第9期55卷 187-187页

作者： Senanayake, Janaka Kalutarage, Harsha Al-Kadri, Mhd Omar Petrovski, Andrei Piras, Luca Robert Gordon Univ Garthdee Rd Aberdeen AB10 7QB Sri Lanka Univ Kelaniya Kelaniya 11600 Western Provinc Sri Lanka Birmingham City Univ Curzon St Birmingham B4 7XG W Midlands England Middlesex Univ London NW4 4BT England

The use of mobile devices is rising daily in this technological era. A continuous and increasing number of mobile applications are constantly offered on mobile marketplaces to fulfil the needs of smartphone users. Many Android applications do not address the security aspects appropriately. This is often due to a lack of automated mechanisms to identify, test, and fix source code vulnerabilities at the early stages of design and development. Therefore, the need to fix such issues at the initial stages rather than providing updates and patches to the published applications is widely recognized. Researchers have proposed several methods to improve the security of applications by detecting source code vulnerabilities and malicious codes. This Systematic Literature Review (SLR) focuses on Android application analysis and source code vulnerability detection methods and tools by critically evaluating 118 carefully selected technical studies published between 2016 and 2022. It highlights the advantages, disadvantages, applicability of the proposed techniques, and potential improvements of those studies. Both Machine Learning (ML)-based methods and conventional methods related to vulnerability detection are discussed while focusing more on ML-based methods, since many recent studies conducted experiments with ML. Therefore, this article aims to enable researchers to acquire in-depth knowledge in secure mobile application development while minimizing the vulnerabilities by applying ML methods. Furthermore, researchers can use the discussions and findings of this SLR to identify potential future research and development directions.

关键词： source code vulnerability vulnerability detection software security Android security machine learning

来源：评论

学校读者我要写书评

暂无评论

A New Framework for Software vulnerability Detection Based on an Advanced Computing

引用

Computers, Materials & Continua 2024年第6期79卷 3699-3723页

作者： Bui Van Cong Cho Do Xuan Department of Information Technology University of Economics and Technical IndustriesHanoi100000Vietnam Faculty of Information Security Posts and Telecommunications Institute of TechnologyHanoi100000Vietnam

The detection of software vulnerabilities written in C and C++languages takes a lot of attention and interest *** paper proposes a new framework called DrCSE to improve software vulnerability *** uses an intelligent computation technique based on the combination of two methods:Rebalancing data and representation learning to analyze and evaluate the code property graph(CPG)of the source code for detecting abnormal behavior of software *** do that,DrCSE performs a combination of 3 main processing techniques:(i)building the source code feature profiles,(ii)rebalancing data,and(iii)contrastive *** which,the method(i)extracts the source code’s features based on the vertices and edges of the *** method of rebalancing data has the function of supporting the training process by balancing the experimental ***,contrastive learning techniques learn the important features of the source code by finding and pulling similar ones together while pushing the outliers *** experiment part of this paper demonstrates the superiority of the DrCSE Framework for detecting source code security vulnerabilities using the Verum *** a result,the method proposed in the article has brought a pretty good performance in all metrics,especially the Precision and Recall scores of 39.35%and 69.07%,respectively,proving the efficiency of the DrCSE *** performs better than other approaches,with a 5%boost in Precision and a 5%boost in ***,this is considered the best research result for the software vulnerability detection problem using the Verum dataset according to our survey to date.

关键词： source code vulnerability source code vulnerability detection code property graph feature profile contrastive learning data rebalancing

来源：评论

学校读者我要写书评

暂无评论

Optimizing software vulnerability detection using RoBERTa and machine learning

引用

AUTOMATED SOFTWARE ENGINEERING 2024年第2期31卷 40-40页

作者： Do, Cho Xuan Luu, Nguyen Trong Nguyen, Phuong Thi Lan Posts & Telecommun Inst Technol Fac Informat Secur Hanoi Vietnam Posts & Telecommun Inst Technol Fac Informat Technol Hanoi Vietnam

Detecting vulnerabilities in source code written in C and C + + is currently essential as attack techniques against systems seek to find, exploit, and attack these vulnerabilities. In this article, to improve the effectiveness of the source code vulnerability detection process, we propose a new approach based on building and representing source code features using natural language processing (NLP) techniques. Our proposal in the article consists of two main stages: (i) building a feature profile of the source code using the RoBERTa model, and (ii) classifying source code based on the feature profile using a supervised machine learning algorithm. Specifically, with our proposal utilizing the pre-trained RoBERTa model, we have successfully built and represented important features of source code as complete vectors, thereby enhancing the effectiveness of prediction and vulnerability detection models. The experimental part of our article compared and evaluated our proposal with other approaches on the FFmpeg + Qume dataset. The experimental results in the article showed that the approach in this study was superior to other research directions on all measures. Therefore, the proposal to use NLP techniques based on the RoBERTa model not only has scientific significance as a new research direction that has not been proposed for application but also has practical significance when all experimental results are highly effective.

关键词： source code vulnerability Software vulnerability detection RoBERTa Machine learning algorithms Natural language processing

来源：评论

学校读者我要写书评

暂无评论

A novel approach for software vulnerability detection based on intelligent cognitive computing

引用

JOURNAL OF SUPERCOMPUTING 2023年第15期79卷 17042-17078页

作者： Xuan, Cho Do Mai, Dao Hoang Thanh, Ma Cong Van Cong, Bui Posts & Telecommun Inst Technol Fac Informat Secur Hanoi Vietnam Univ Edinburgh Edinburgh Scotland Univ Econ & Tech Ind Dept Informat Technol Hanoi Vietnam

Improving and enhancing the effectiveness of software vulnerability detection methods is urgently needed today. In this study, we propose a new source code vulnerability detection method based on intelligent and advanced computational algorithms. It's a combination of four main processing techniques including (i) source Embedding, (ii) Feature Learning, (iii) Resampling Data, and (iv) Classification. The source Embedding method will perform the task of analyzing and standardizing the source code based on the Joern tool and the data mining algorithm. The Feature Learning model has the function of aggregating and extracting source code attribute based on node using machine learning and deep learning methods. The Resampling Data technique will perform equalization of the experimental dataset. Finally, the Classification model has the function of detecting source code vulnerabilities. The novelty and uniqueness of the new intelligent cognitive computing method is the combination and synchronous use of many different data extracting techniques to compute, represent, and extract the properties of the source code. With this new calculation method, many significant unusual properties and features of the vulnerability have been synthesized and extracted. To prove the superiority of the proposed method, we experiment to detect source code vulnerabilities based on the Verum dataset, details of this part are presented in the experimental section. The experimental results show that the method proposed in the paper has brought good results on all measures. These results have shown to be the best research results for the source code vulnerability detection task using the Verum dataset according to our survey to date. With such results, the proposal in this study is not only meaningful in terms of science but also in practical terms when the method of using intelligent cognitive computing techniques to analyze and evaluate source code has helped to improve the efficiency of the sou

关键词： source code vulnerability source code vulnerability detection code property graph source embedding Data rebalancing Feature learning Classification

来源：评论

学校读者我要写书评

暂无评论

Enhancing Security Assurance in Software Development: AI-Based Vulnerable code Detection with Static Analysis

Enhancing Security Assurance in Software Development: AI-Bas...

引用

28th European Symposium on Research in Computer Security (ESORICS)

作者： Rajapaksha, Sampath Senanayake, Janaka Kalutarage, Harsha Al-Kadri, Mhd Omar Robert Gordon Univ Sch Comp Aberdeen AB10 7QB Scotland Univ Doha Sci & Technol Doha Qatar

ISBN: (纸本)9783031541285;9783031541292

The presence of vulnerable source code in software applications is causing significant reliability and security issues, which can be mitigated by integrating and assuring software security principles during the early stages of the development lifecycle. One promising approach to identifying vulnerabilities in source code is the use of Artificial Intelligence (AI). This research proposes an AI-based method for detecting source code vulnerabilities and leverages Explainable AI to help developers identify and understand vulnerable source code tokens. To train the model, a web crawler was used to collect a real-world dataset of 600,000 source code samples, which were annotated using static analysers. Several ML classifiers were tested on a feature vector generated using Natural Language Processing techniques. The Random Forest and Extreme Gradient Boosting classifiers were found to perform well in binary and multi-class approaches, respectively. The proposed model achieved a 0.96 F1-Score in binary classification and a 0.85 F1-Score in multi-class classification based on Common Weakness Enumeration (CWE) IDs. The model, trained on a dataset of actual source codes, is highly generalisable and has been integrated into a live web portal to validate its performance on real-world code vulnerabilities.

关键词： source code vulnerability artificial intelligence software security vulnerability scanners

来源：评论

学校读者我要写书评

暂无评论

Systematic Analysis of Deep Learning Model for Vulnerable code Detection 46

Systematic Analysis of Deep Learning Model for Vulnerable Co...

引用

46th Annual IEEE-Computer-Society International Computers, Software, and Applications Conference (COMPSAC) - Computers, Software, and Applications in an Uncertain World

作者： Bin Nazim, Mohammad Taneem Faruk, Md Jobair Hossain Shahriar, Hossain Khan, Md Abdullah Masum, Mohammad Sakib, Nazmus Wu, Fan Kennesaw State Univ Dept Comp Sci Kennesaw GA 30144 USA Kennesaw State Univ Dept Software Engn & Game Dev Kennesaw GA 30144 USA Kennesaw State Univ Dept Informat Technol Kennesaw GA 30144 USA Kennesaw State Univ Sch Data Sci Kennesaw GA 30144 USA Tuskegee Univ Dept Comp Sci Tuskegee AL 36088 USA

ISBN: (纸本)9781665488105

Software vulnerabilities have become a serious problem with the emergence of new applications that contain potentially vulnerable or malicious code that can compromise the system. The growing volume and complexity of software source codes have opened a need for vulnerability detection methods to successfully predict malicious codes before being the prey of cyberattacks. As leveraging humans to check sources codes requires extensive time and resources and preexisting static code analyzers are unable to properly detect vulnerable codes. Thus, artificial intelligence techniques, mainly deep learning models, have gained traction to detect source code vulnerability. A systematic review is carried out to explore and understand the various deep learning methods employed for the task and their efficacy as a prediction model. Additionally, a summary of each process and its characteristics are examined and its implementation on specific data sets and their evaluation will be discussed.

关键词： Deep Learning Software Security source code vulnerability

来源：评论

学校读者我要写书评

暂无评论

Quantum Machine Learning for Software Supply Chain Attacks: How Far Can We Go? 46

Quantum Machine Learning for Software Supply Chain Attacks: ...

引用

46th Annual IEEE-Computer-Society International Computers, Software, and Applications Conference (COMPSAC) - Computers, Software, and Applications in an Uncertain World

作者： Masum, Mohammad Nazim, Mohammad Faruk, Md Jobair Hossain Shahriar, Hossain Valero, Maria Khan, Md Abdullah Hafiz Uddin, Gias Barzanjeh, Shabir Saglamyurek, Erhan Rahman, Akond Ahamed, Sheikh Iqbal Kennesaw State Univ Analyt & Data Sci Inst Kennesaw GA 30144 USA Kennesaw State Univ Dept Comp Sci Kennesaw GA 30144 USA Kennesaw State Univ Dept Software Engn & Game Dev Kennesaw GA 30144 USA Kennesaw State Univ Dept Informat Technol Kennesaw GA 30144 USA Univ Calgary Inst Quantum Sci & Technol Elect & Software Engn Calgary AB Canada Tennessee Technol Univ Dept Comp Sci Cookeville TN USA Marquette Univ Dept Comp Sci Milwaukee WI 53233 USA

ISBN: (纸本)9781665488105

Quantum Computing (QC) has gained immense popularity as a potential solution to deal with the ever-increasing size of data and associated challenges leveraging the concept of quantum random access memory (QRAM). QC promises-quadratic or exponential increases in computational time with quantum parallelism and thus offer a huge leap forward in the computation of Machine Learning algorithms. This paper analyzes speed up performance of QC when applied to machine learning algorithms, known as Quantum Machine Learning (QML). We applied QML methods such as Quantum Support Vector Machine (QSVM), and Quantum Neural Network (QNN) to detect Software Supply Chain (SSC) attacks. Due to the access limitations of real quantum computers, the QML methods were implemented on open-source quantum simulators such as IBM Qiskit and TensorFlow Quantum. We evaluated the performance of QML in terms of processing speed and accuracy and finally, compared with its classical counterparts. Interestingly, the experimental results differ to the speed up promises of QC by demonstrating higher computational time and lower accuracy in comparison to the classical approaches for SSC attacks.

关键词： Quantum Computing Quantum Machine Learning Software Supply Chain Software Security source code vulnerability Quantum Support Vector Machine Quantum Neural Network

来源：评论

学校读者我要写书评

暂无评论

source code vulnerabilities detection using loosely coupled data and control flows 21

Source code vulnerabilities detection using loosely coupled ...

引用

21st International Symposium on Symbolic and Numeric Algorithms for Scientific Computing (SYNASC)

作者： Zaharia, Sergiu Rebedea, Traian Trausan-Matu, Stefan Univ Politehn Bucuresti Bucharest Romania

ISBN: (纸本)9781728157245

Applications are one of the most used attack surfaces, and they must be secured at source code level, early in the development phase. Static Analysis Security Testing solutions, able to detect vulnerabilities in source code are limited to the most used programming languages and development frameworks. The proposed method consists of a security scanning solution based on an Intermediate Representation of source code which is loosely coupled with the programming language structure and to the data flow, preserving at the same time the security vulnerability patterns. The ability to identify vulnerable source code snippets in the Intermediate Representation of the original source code is the core idea for this research project. Using loosely coupled control flows and data flows representations of the original source code enables the development of new security scanners, which in the future will be able to evaluate applications written in new and exotic languages.

关键词： software and application security software security engineering machine learning source code vulnerability

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：