检索结果-内蒙古大学图书馆

DB-CBIL: A DistilBert-Based Transformer Hybrid Model Using CNN and BiLSTM for Software Vulnerability Detection

IEEE ACCESS 2024年 12卷 64446-64460页

作者： Bahaa, Ahmed Kamal, Aya El-Rahman Fahmy, Hanan Ghoneim, Amr S. Helwan Univ Fac Comp & Artificial Intelligence Dept Informat Syst Helwan 11795 Egypt Beni Suef Univ Fac Comp & Artificial Intelligence Dept Informat Syst Bani Suwayf 62521 Egypt Helwan Univ Fac Comp & Artificial Intelligence Dept Comp Sci Helwan 11795 Egypt

Software vulnerabilities are among the significant causes of security breaches. Vulnerabilities can severely compromise software security if exploited by malicious attacks and may result in catastrophic losses. Hence, Automatic vulnerability detection methods promise to mitigate attack risks and safeguard software security. This paper introduces a novel model for automatic vulnerability detection of source code vulnerabilities dubbed DB-CBIL using a hybrid deep learning model based on Distilled Bidirectional Encoder Representations from Transformers (DistilBERT). The proposed model considers contextualized word embeddings using the language model for the syntax and semantics of source code functions based on the Abstract Syntax Tree (AST) representation. The model includes two main phases. First, using a vulnerable code dataset, the pre-trained DistilBert transformer is fine-tuned for word embedding. Second, a hybrid deep learning model detects which code functions are vulnerable. The hybrid model is built on two Deep Neural Networks (DNN). The first model is the Convolutional Neural Network (CNN), which is used for extracting features. The second model is Bidirectional-LSTM (BiLSTM), which has been used to maintain the sequential order of the data as it can handle lengthy token sequences. The utilized source code dataset is derived from the Software Assurance Reference Database (SARD) benchmark dataset. Final experimental findings show that the proposed model outperforms the state-of-the-art approaches' performance by improving precision, recall, F1-score, and False Negative Rate (FNR) by 2.41%-8.95%, 4.0%-16.28%, 1.85%-12.74%, and 18% respectively. The proposed model reports the lowest FNR in the literature, a significant achievement given the cost-based nature of vulnerability detectors.

关键词： Convolutional neural networks Codes Transformers source coding Security Feature extraction Detection algorithms Deep learning Software quality Automatic vulnerability detection BERT deep learning DistilBERT transformers

来源：评论

学校读者我要写书评

暂无评论

Gotcha! This Model Uses My Code! Evaluating Membership Leakage Risks in Code Models

引用

IEEE TRANSACTIONS ON SOFTWARE ENGINEERING 2024年第12期50卷 3290-3306页

作者： Yang, Zhou Zhao, Zhipeng Wang, Chenyu Shi, Jieke Kim, Dongsun Han, Donggyun Lo, David Singapore Management Univ Sch Comp & Informat Syst Singapore 188065 Singapore Univ Copenhagen DK-1165 Copenhagen Denmark Korea Univ Seoul 02841 South Korea Royal Holloway Univ London Egham TW20 0EX England

Leveraging large-scale datasets from open-source projects and advances in large language models, recent progress has led to sophisticated code models for key software engineering tasks, such as program repair and code completion. These models are trained on data from various sources, including public open-source projects like GitHub and private, confidential code from companies, raising significant privacy concerns. This paper investigates a crucial but unexplored question: What is the risk of membership information leakage in code models? Membership leakage refers to the vulnerability where an attacker can infer whether a specific data point was part of the training dataset. We present Gotcha, a novel membership inference attack method designed for code models, and evaluate its effectiveness on Java-based datasets. Gotcha simultaneously considers three key factors: model input, model output, and ground truth. Our ablation study confirms that each factor significantly enhances attack performance. Our ablation study confirms that each factor significantly enhances attack performance. Our investigation reveals a troubling finding: membership leakage risk is significantly elevated. While previous methods had accuracy close to random guessing, Gotcha achieves high precision, with a true positive rate of 0.95 and a low false positive rate of 0.10. We also demonstrate that the attacker's knowledge of the victim model (e.g., model architecture and pre-training data) affects attack success. Additionally, modifying decoding strategies can help reduce membership leakage risks. This research highlights the urgent need to better understand the privacy vulnerabilities of code models and develop strong countermeasures against these threats.

关键词： Codes Data models Training data Training Information leakage Software development management Data privacy Privacy Decoding source coding Membership inference attack privacy large language models for code code completion

来源：评论

学校读者我要写书评

暂无评论

Generalized Universal coding of Integers

引用

IEEE TRANSACTIONS ON COMMUNICATIONS 2024年第8期72卷 4538-4550页

作者： Yan, Wei Han, Yunghsiang S. Natl Univ Def Technol Coll Elect Engn Hefei 230037 Peoples R China Anhui Prov Key Lab Cyberspace Secur Situat Awaren Hefei 230037 Peoples R China Univ Elect Sci & Technol China Shenzhen Inst Adv Study Shenzhen Peoples R China

Universal coding of integers (UCI) is a class of variable-length code such that the ratio of the expected codeword length to max{1, H(P)} is bounded by a constant factor, where H(P) is the Shannon entropy of the decreasing probability distribution P. However, if we consider the ratio of the expected codeword length to H(P) for UCI, the ratio tends to infinity when H(P) tends to zero. To resolve this issue, we introduce a class of codes, called generalized universal coding of integers (GUCI), where the ratio of the expected codeword length to H(P) is bounded by a constant factor K. First, the definition of GUCI is proposed. The coding structure of GUCI is introduced. Next, we propose a class of GUCIs C to reach the expansion factor K-C = 2 , and we show that the smallest minimum expansion factor is in the range 1 <= K-& lowast;<= 2 . Then, by comparing UCI and GUCI, we show that when the entropy is very large or P(0) is not large, there are also cases where the average codeword length of GUCI is shorter. Finally, the asymptotically optimal GUCI is presented.

关键词： Universal coding of integers source coding Elias coding Universal coding of integers source coding Elias coding

来源：评论

学校读者我要写书评

暂无评论

TFHSVul: A Fine-Grained Hybrid Semantic Vulnerability Detection Method Based on Self-Attention Mechanism in IoT

引用

IEEE INTERNET OF THINGS JOURNAL 2025年第1期12卷 30-44页

作者： Xu, Lijuan An, Baolong Li, Xin Zhao, Dawei Peng, Haipeng Song, Weizhao Tong, Fenghua Han, Xiaohui Qilu Univ Technol Shandong Acad Sci Shandong Comp Sci Ctr Natl Supercomp Ctr JinanKey Lab Comp Power Networ Jinan 250014 Peoples R China Beijing Univ Posts & Telecommun Informat Secur Ctr State Key Lab Networking & Switching Technol Beijing 100876 Peoples R China Beijing Univ Posts & Telecommun Natl Engn Lab Disaster Backup & Recovery Beijing 100876 Peoples R China

Current vulnerability detection methods encounter challenges, such as inadequate feature representation, constrained feature extraction capabilities, and coarse-grained detection. To address these issues, we propose a fine-grained hybrid semantic vulnerability detection framework based on Transformer, named TFHSVul. Initially, the source code is transformed into sequential and graph-based representations to capture multilevel features, thereby solving the problem of insufficient information caused by a single intermediate representation. To enhance feature extraction capabilities, TFHSVul integrates multiscale fusion convolutional neural network, residual graph convolutional network, and pretrained language model into the core architecture, significantly boosting performance. We design a fine-grained detection method based on a self-attention mechanism, achieving statement-level detection to address the issue of coarse detection granularity. In comparison to existing baseline methods on public data sets, TFHSVul achieves a 0.58 improvement in F1 score at the function level compared to the best performing model. Moreover, it demonstrates a 10% enhancement in Top-10 accuracy at the statement-level detection compared to the best performing method.

关键词： Codes Internet of Things Feature extraction source coding Security Accuracy Semantics Deep learning network security software vulnerabilities vulnerability detection

来源：评论

学校读者我要写书评

暂无评论

Programmer Visual Attention During Context-Aware Code Summarization

引用

IEEE TRANSACTIONS ON SOFTWARE ENGINEERING 2025年第5期51卷 1524-1537页

作者： Wallace, Robert Bansal, Aakash Karas, Zachary Tang, Ningzhi Huang, Yu Jia-Jun Li, Toby McMillan, Collin Univ Notre Dame Dept Comp Sci & Engn Notre Dame IN 46556 USA Vanderbilt Univ Dept Comp Sci Nashville TN 37235 USA

Programmer attention represents the visual focus of programmers on parts of the source code in pursuit of programming tasks. The focus of current research in modeling this programmer attention has been on using mouse cursors, keystrokes, or eye tracking equipment to map areas in a snippet of code. These approaches have traditionally only mapped attention for a single method. However, there is a knowledge gap in the literature because programming tasks such as source code summarization require programmers to use contextual knowledge that can only be found in other parts of the project, not only in a single method. To address this knowledge gap, we conducted an in-depth human study with 10 Java programmers, where each programmer generated summaries for 40 methods from five large Java projects over five one-hour sessions. We used eye tracking equipment to map the visual attention of programmers while they wrote the summaries. We also rate the quality of each summary. We found eye-gaze patterns and metrics that define common behaviors between programmer attention during context-aware code summarization. Specifically, we found that programmers need to read up to 35% fewer words (p < 0.01) over the whole session, and revisit 13% fewer words (p < 0.03) as they summarize each method during a session, while maintaining the quality of summaries. We also found that the amount of source code a participant looks at correlates with a higher quality summary, but this trend follows a bell-shaped curve, such that after a threshold reading more source code leads to a significant decrease (p < 0.01) in the quality of summaries. We also gathered insight into the type of methods in the project that provide the most contextual information for code summarization based on programmer attention. Specifically, we observed that programmers spent a majority of their time looking at methods inside the same class as the target method to be summarized. Surprisingly, we found that programmers spent

关键词： Codes Visualization source coding Gaze tracking Unified modeling language Java Context modeling Cognitive science Algorithms Programming Automatic documentation generation source code summarization neural networks context-aware models

来源：评论

学校读者我要写书评

暂无评论

Development of a Framework-Independent Code Generator From State Machine Diagrams

引用

IEEE ACCESS 2024年 12卷 125108-125124页

作者： Jung, Seungmo Lee, Woojin Kyungpook Natl Univ Sch Comp Sci & Engn Daegu 41566 South Korea

State machine diagrams offer the advantage of expressing the system clearly and easily to understand because they express the operation of the system in highly readable graphics. In addition, codes can be automatically generated from models created using modeling tools, contributing to the development of high-quality software. Despite these benefits, code generated from the modeling tool's framework is often inaccessible to domain software, limiting the ability to modify or verify it. Additionally, the additional code generated to perform the various functions of the modeling tool is unnecessary code for the functions of the domain software and affects limited resources such as memory usage. As a solution, this paper proposes a method for developing an automatic model code generator that produces framework-independent code from state machine diagrams. The automatic model code generator uses a state machine diagram as input to automatically generate source code through the steps of extraction model design, extraction model implementation, implementation model creation, and model code generation. The functionality and performance of this method are validated by comparing the code generated using the automatic model code generator with that generated using the modeling tool. The experimental results in the naval combat system environment show no difference in functionality, demonstrating efficient performance concerning resource utilization, including memory usage. Using the method proposed in this paper has the advantage of being able to apply it flexibly by solving the problem of not being able to apply state machine diagrams due to the framework-dependent code of the modeling tool.

关键词： Unified modeling language Codes Generators Software development management source coding Solid modeling Model driven engineering model-driven development state machine diagrams automatic code generation naval combat system software

来源：评论

学校读者我要写书评

暂无评论

Properties of k-Bit Delay Decodable Codes

引用

IEICE TRANSACTIONS ON FUNDAMENTALS OF ELECTRONICS COMMUNICATIONS AND COMPUTER SCIENCES 2024年第3期E107A卷 417-447页

作者： Hashimoto, Kengo Iwata, Ken-Ichi Univ Fukui Fukui 9108507 Japan

The class of k -bit delay decodable codes, source codes allowing decoding delay of at most k bits for k >= 0, can attain a shorter average codeword length than Huffman codes. This paper discusses the general properties of the class of k -bit delay decodable codes with a finite number of code tables and proves two theorems which enable us to limit the scope of codes to be considered when discussing optimal k -bit delay decodable codes.

关键词： data compression source coding decoding delay

来源：评论

学校读者我要写书评

暂无评论

A Holistic Approach to Design Understanding Through Concept Explanation

引用

IEEE TRANSACTIONS ON SOFTWARE ENGINEERING 2025年第2期51卷 449-465页

作者： Fang, Hongzhou Cai, Yuanfang Tempero, Ewan Kazman, Rick Tu, Yu-Cheng Lefever, Jason Pisch, Ernst Drexel Univ Dept Comp Sci Philadelphia PA 19104 USA Univ Auckland Sch Comp Sci Auckland 1142 New Zealand Univ Hawaii Shidler Coll Business Honolulu HI 96822 USA

Complex software systems consist of multiple overlapping design structures, such as abstractions, features, crosscutting concerns, or patterns. This is similar to how a human body has multiple interacting subsystems, such as respiratory, digestive, or circulatory. Unlike in the medical domain, software designers do not have an effective way to distinguish, visualize, comprehend, and analyze these interleaving design structures. As a result, developers often struggle through the maze of source code. In this paper, we present an Automated Concept Explanation (ACE) framework that automatically extracts and categorizes major concepts from source code based on the roles that files play in design structures and their topic frequencies. Based on these categorized concepts, ACE recovers four categories of high-level design models using different algorithms and generates a natural language explanation for each. To assess if and how ACE can help developers better understand design structures, we conducted an empirical study where two groups of graduate students were assigned three design comprehension tasks: identifying feature-related files, identifying dependencies among features, and identifying design patterns used, in an open-source project. The results reveal that the students who used ACE can accomplish these tasks much faster and more accurately, and they acknowledged the usefulness of the categorized concepts and structures, multi-type high-level model visualization, and natural language explanations.

关键词： Feature extraction source coding Natural languages Visualization Computer science Codes Software systems Prototypes Weaving Vectors Software design software comprehension natural language processing

来源：评论

学校读者我要写书评

暂无评论

Successive Refinement of Shannon Cipher System Under Maximal Leakage

引用

IEEE TRANSACTIONS ON INFORMATION THEORY 2025年第3期71卷 1487-1503页

作者： Wu, Zhuangfei Bai, Lin Zhou, Lin Beihang Univ Sch Cyber Sci & Technol Beijing 100191 Peoples R China Zhongguancun Lab Beijing 100191 Peoples R China

We study the successive refinement setting of Shannon cipher system (SCS) under the maximal leakage secrecy metric for discrete memoryless sources under bounded distortion measures. Specifically, we generalize the threat model for the point-to-point rate-distortion setting of Issa, Wagner and Kamath (T-IT 2020) to the multiterminal successive refinement setting. Under mild conditions that correspond to partial secrecy, we characterize the asymptotically optimal normalized maximal leakage region for both the joint excess-distortion probability (JEP) and the expected distortion reliability constraints. Under JEP, in the achievability part, we propose a type-based coding scheme, analyze the reliability guarantee for JEP and bound the leakage of the information source through compressed messages. In the converse part, by analyzing a guessing scheme of the eavesdropper, we prove the optimality of our achievability result. Under expected distortion, the achievability part is established similarly to the JEP counterpart. The converse proof proceeds by generalizing the corresponding results for the rate-distortion setting of SCS by Schieler and Cuff (T-IT 2014) to the successive refinement setting. Somewhat surprisingly, the normalized maximal leakage regions under both JEP and expected distortion constraints are identical under certain conditions, although JEP appears to be a stronger reliability constraint.

关键词： Distortion Distortion measurement Rate-distortion Decoding Ciphers Codes Channel coding Random variables Information leakage Analytical models Discrete memoryless source rate-distortion information forensics source coding physical layer security

来源：评论

学校读者我要写书评

暂无评论

"Paper, Meet Code": A Deep Learning Approach to Linking Scholarly Articles With GitHub Repositories

引用

IEEE ACCESS 2024年 12卷 68410-68426页

作者： Puangjaktha, Prahyat Choetkiertikul, Morakot Tuarob, Suppawong Mahidol Univ Fac Informat & Commun Technol Salaya 73170 Thailand

Computer scientists often publish their source code accompanying their publications, prominently using code repositories across various domains. Despite the concurrent existence of scholarly articles and their associated official code repositories, explicit references linking the two are often missing. Traditionally, identifying whether scholarly content and code repositories pertain to the same research project requires manual inspection, a time-consuming task. This paper proposes a deep learning-based algorithm for automatically matching scholarly articles with their corresponding official code repositories. Our findings indicate that the most common linking information includes the paper title and BibTeX entries, typically found in the repository's readme document. In this study, we employed SPECTER for vector embedding of paper and repository metadata. Utilizing these embedding representations with the Light Gradient Boosting Machine (LGBM), our method achieved an F1 score of 0.94. Moreover, combining our best model with a rule-based approach improved performance by 5.31%. This study successfully delineates a connection between academic papers and associated official code repositories, minimizing reliance on explicit bibliographic information in repositories.

关键词： Software development management Codes source coding Focusing Task analysis Software algorithms Deep learning Text recognition Information representation Machine learning Academic code repository mining paper-repository relationship text representation machine learning

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：