微信服务号

微信订阅号

2025年3月25日 10:12 星期二
首页 > 过刊浏览>2020年第31卷第7期 >2040-2061. DOI:10.13328/j.cnki.jos.006055
PDF HTML阅读 XML下载 导出引用 引用提醒
基于机器学习的软件漏洞挖掘方法综述
作者:
作者简介:

李韵(1996-),女,硕士,主要研究领域为系统安全;袁露(1992-),男,硕士,CCF学生会员,主要研究领域为可信计算;黄辰林(1976-),男,博士,研究员,CCF专业会员,主要研究领域为操作系统,可信计算;王晓川(1976-),男,博士,副研究员,主要研究领域为操作系统,分布式计算;王中锋(1976-),男,高级工程师,主要研究领域为网络威胁监测与分析.

通讯作者:

黄辰林,E-mail:clhuang@nudt.edu.cn

基金项目:

国家重点研发计划（2018YFB0803501）


Survey of Software Vulnerability Mining Methods Based on Machine Learning
Author:
Fund Project:

National Key Technologies Research and Development Program, China (2018YFB0803501)

  • 摘要
    • | |
  • 访问统计
    • |
  • 参考文献 [110]
    • |
  • 相似文献 [20]
    • | | |
  • 文章评论
    摘要:

    软件复杂性的增加，给软件安全性带来极大的挑战.随着软件规模的不断增大以及漏洞形态多样化，传统漏洞挖掘方法由于存在高误报率和高漏报率的问题，已无法满足复杂软件的安全性分析需求.近年来，随着人工智能产业的兴起，大量机器学习方法被尝试用于解决软件漏洞挖掘问题.首先，通过梳理基于机器学习的软件漏洞挖掘的现有研究工作，归纳了其技术特征与工作流程；接着，从其中核心的原始数据特征提取切入，以代码表征形式作为分类依据，对现有研究工作进行分类阐述，并系统地进行了对比分析；最后，依据对现有研究工作的整理总结，探讨了基于机器学习的软件漏洞挖掘领域面临的挑战，并展望了该领域的发展趋势.

    Abstract:

    The increasing complexity of software application brings great challenges to software security. Due to the increase of software scale and diversity of vulnerability forms, the high false positives and false negatives of traditional vulnerability mining methods cannot meet the requirements of software security analysis. In recent years, with the rise of artificial intelligence industry, a large number of machine learning methods have been tried to solve the problem of software vulnerability mining. Firstly, the latest research results of applying machine learning method to the research of vulnerability mining are summarized in recent years, and the technical characteristics and workflow are proposed. Then, starting from the core original data features extraction, the existing research is classified according to the code representation form, and the existing research is systematically compared. Finally, based on the summary of the existing research, the challenges in the field of software vulnerability mining based on machine learning are discussed, and the development trends of this field are proposed.

    参考文献
    [1] Ministry of Industry and Information Technology of People's Republic of China. 2018(in Chinese with English). http://www.miit.gov.cn/
    [2] Linux. 2018. https://github.com/torvalds/linux
    [3] CVE details. 2019. https://www.cvedetails.com/
    [4] Wu SZ. Review and outlook of information security vulnerability analysis. Journal of Tsinghua University (Science and Technology), 2009,49(S2):2065-2072(in Chinese with English abstract).[doi:10.16511/j.cnki. qhdxxb.2009.s2.005]
    [5] Wu SZ, Guo T, Dong GW, Wang JJ. Software vulnerability analyses:A road map. Journal of Tsinghua University (Science and Technology), 2012,52(10):1309-1319(in Chinese with English abstract).[doi:10.16511/j.cnki.qhdxxb.2012.10.001]
    [6] Coverity:Coverity scan static analysis. 2020. https://scan.coverity.com/
    [7] KlockWork:Static code analysis for C, C++, C#, and Java. 2020. https://www.perforce.com/products/klocwork
    [8] Gao Q, Zhang S, Chen X, Ma S, Shao S, Sui Y, Zhao G, Ma L, Ma X, Duan F, Deng X. CoBOT:Static C/C++ bug detection in the presence of incomplete code. In:Proc. of the 26th Conf. on Program Comprehension (ICPC 2018). New York:Association for Computing Machinery, 2018. 385-388.[doi:10.1145/3196321.3196367]
    [9] Cadar C, Dunbar D, Engler DR. KLEE:Unassisted and automatic generation of high-coverage tests for complex systems programs. OSDI, 2008,8:209-224.
    [10] Chipounov V, Kuznetsov V, Candea G. S2E:A platform for in-vivo multi-path analysis of software systems. In:Proc. of the 16th Int'l Conf. on Architectural Support for Programming Languages and Operating Systems. ACM, 2011.[doi:10.1145/2248487. 1950396]
    [11] Cha SK, Avgerinos T, Rebert A, Brumley D. Unleashing mayhem on binary code. In:Proc. of the 2012 IEEE Symp. on Security and Privacy. IEEE, 2012. 380-394.[doi:10.1109/SP.2012.31]
    [12] LibFuzzer:A library for coverage-guided fuzz testing. 2020. http://llvm.org/docs/LibFuzzer.html
    [13] Vimpari M. An evaluation of free fuzzing tools[MS. Thesis]. University of Oulu, 2015.
    [14] AFL:American fuzzy lop. 2020. https://lcamtuf.coredump.cx/afl/
    [15] Song CX, Wang X, Zhang WZ. Anlysis and optimization of angr in dynamic software test application. Computer Engineering & Science, 2018,40(S1):167-172(in Chinese with English abstract).[doi:10.3969/j.issn.1007-130X.2018.Suppl (1).030]
    [16] Godefroid P, Levin MY, Molnar D. SAGE:Whitebox fuzzing for security testing. Communications of the ACM, 2012,55(3):40-44.[doi:10.1145/2093548.2093564]
    [17] Bochspwn. 2020. https://github.com/googleprojectzero/bochspwn
    [18] Pan J, Yan G, Fan X. Digtool:A virtualization-based framework for detecting kernel vulnerabilities. In:Proc. of the 26th USENIX Security Symp. (USENIX Security 2017). 2017. 149-165. https://www.usenix.org/conference/usenixsecurity17/technical-sessions/spresentation/pan
    [19] Syzkaller. 2020. https://github.com/google/syzkaller
    [20] Rapidscan. 2020. https://github.com/skavngr/rapidscan
    [21] Zhang X, Li ZJ. Survey of fuzz testing technology. Computer Science, 2016,43(5):1-8(in Chinese with English abstract).[doi:10.11896/j.issn.1002-137X.2016.5.001]
    [22] Ye ZB, Yan B. Survey of symbolic execution. Computer Science, 2018,45(s1):28-35(in Chinese with English abstract).[doi:CNKI:SUN:JSJA.0.2018-S1-006]
    [23] Zou QC, Zhang T, Wu RP, Ma JX, Li MC, Chen C, Hou CY. From automation to intelligence:Survey of research on vulnerability discovery techniques. Journal of Tsinghua University (Science and Technology), 2018,58(12):45-60(in Chinese with English abstract).[doi:10.16511/j.cnki.qhdxxb.2018.21.025]
    [24] Hindle A, Barr ET, Su Z, Gabel M, Devanbu P. On the naturalness of software. In:Proc. of the 34th Int'l Conf. on Software Engineering (ICSE). IEEE, 2012. 837-847.[doi:10.1109/ICSE.2012.6227135]
    [25] Sun HY, He Y, Wang JC, Dong Y, Zhu LP, Wang H, Zhang YQ. Application of artificial intelligence technology in the field of security vulnerability. Journal on Communications, 2018,39(8):1-17(in Chinese with English abstract).[doi:10.11959/j.issn. 1000-436x.2018137]
    [26] Perl H, Dechand S, Smith M, Arp D, Yamaguchi F, Rieck K, Fahl S, Acar Y. VCCFinder:Finding potential vulnerabilities in open-source projects to assist code audits. In:Proc. of the ACM SIGSAC Conf. on Computer & Communications Security. 2015.[doi:http://dx.doi.org/10.1145/2810103.2813604]
    [27] Agrawal A, Menzies T. Is "better data" better than "better data miners"? On the benefits of tuning smote for defect prediction. In:Proc. of the 40th Int'l Conf. on Software Engineering. ACM, 2018. 1050-1061.[doi:https://doi.org/10.1145/3180155.3180197]
    [28] Meng Q, Shameng W, Chao F, Chaojing T. Predicting buffer overflow using semi-supervised learning. In:Proc. of the 9th Int'l Congress on Image and Signal Processing, BioMedical Engineering and Informatics (CISP-BMEI). IEEE, 2016. 1959-1963.[doi:10.1109/CISP-BMEI.2016.7853039]
    [29] Dam HK, Tran T, Pham T, Ng SW, Grundy J, Ghose A. Automatic feature learning for vulnerability prediction. arXiv Preprint arXiv:1708.02368, 2017.
    [30] Yamaguchi F, Maier A, Gascon H, Rieck K. Automatic inference of search patterns for taint-style vulnerabilities. In:Proc. of the IEEE Symp. on Security & Privacy. 2015.[doi:10.1109/SP.2015.54]
    [31] Zhen L, Zou D, Xu S, Ou X, Hai J, Wang S, Deng Z, Zhong Y. VulDeePecker:A deep learning-based system for vulnerability detection. In:Proc. of the 25th Annual Network and Distributed System Security Symp. (NDSS). 2018.[doi:http://dx.doi.org/10.14722/ndss.2018.23158]
    [32] Lin G, Zhang J, Luo W, Pan L, Xiang Y, Vel OD, Montague P. Cross-project transfer representation learning for vulnerable function discovery. IEEE Trans. on Industrial Informatics, 2018,14(7):1.[doi:10.1109/TII.2018.2821768]
    [33] Younis A, Malaiya YK, Anderson C, Ray I. To fear or not to fear that is the question:Code characteristics of a vulnerable function with an existing exploit. In:Proc. of the Conf. on Data & Applications Security & Privacy. 2016.[doi:10.1145/2857705.2857750]
    [34] Shin Y, Williams L. Is complexity really the enemy of software security? In:Proc. of the ACM Workshop on Quality of Protection. 2008.[doi:10.1145/1456362.1456372]
    [35] Shin Y, Williams L. An empirical model to predict security vulnerabilities using code complexity metrics. In:Proc. of the Int'l Symp. on Empirical Software Engineering & Measurement. 2008.[doi:10.1145/1414004.1414065]
    [36] Bass L, Clements P, Kazman R. Software Architecture in Practice. Addison-Wesley, 2003.
    [37] Fenton N, Bieman J. Software Metrics:A Rigorous and Practical Approach. 3rd ed., CRC Press, 2014.
    [38] Chowdhury I, Zulkernine M. Can complexity, coupling, and cohesion metrics be used as early indicators of vulnerabilities? In:Proc. of the 2010 ACM Symp. on Applied Computing. New York:ACM, 2010. 1963-1969.[doi:10.1145/1774088.1774504]
    [39] Chowdhury I, Zulkernine M. Using complexity, coupling, and cohesion metrics as early indicators of vulnerabilities. Journal of Systems Architecture, 2011,57(3):294-313.[doi:10.1016/j.sysarc.2010.06.003]
    [40] Zimmermann T, Nagappan N, Williams LA. Searching for a needle in a haystack:Predicting security vulnerabilities for windows vista. In:Proc. of the Int'l Conf. on Software Testing. 2010.[doi:10.1109/ICST.2010.32]
    [41] Morrison P, Herzig K, Murphy B, Williams L. Challenges with applying vulnerability prediction models. In:Proc. of the 2015 Symp. and Bootcamp on the Science of Security. ACM, 2015. 4.[doi:http://dx.doi.org/10.1145/2746194.2746198]
    [42] Bozorgi M, Saul LK, Savage S, Voelker GM. Beyond heuristics:Learning to classify vulnerabilities and predict exploits. In:Proc. of the 16th ACM SIGKDD Int'l Conf. on Knowledge Discovery and Data Mining. ACM, 2010. 105-114.[doi:10.1145/1835804. 1835821]
    [43] Wang FX, Li F. Software vulnerability automatic classification framework based on activation vulnerability conditions. Journal of Chongqing University of Technology (Natural Science), 2019,5:154-160(in Chinese with English abstract).[doi:10.3969/j.issn. 1674-8425(z).2019.05.025]
    [44] Rice HG. Classes of recursively enumerable sets and their decision problems. Trans. of the American Mathematical Society, 1953, 74(2):358-366.[doi:10.2307/1990888]
    [45] Meng Q, Zhang B, Feng C, Tang C. Detecting buffer boundary violations based on SVM. In:Proc. of the 3rd Int'l Conf. on Information Science and Control Engineering (ICISCE). IEEE, 2016. 313-316.[doi:10.1109/ICISCE.2016.76]
    [46] Yamaguchi F, Lindner F, Rieck K. Vulnerability extrapolation:Assisted discovery of vulnerabilities using machine learning. In:Proc. of the 5th USENIX Workshop on Offensive Technologies (WOOT). USENIX Association, 2011. 13-13.
    [47] Li R, Feng C, Zhang X, Tang C. A lightweight assisted vulnerability discovery method using deep neural networks. IEEE Access, 2019,7:80079-80092.[doi:10.1109/ACCESS.2019.2923227]
    [48] Scandariato R, Walden J, Hovsepyan A, Joosen W. Predicting vulnerable software components via text mining. IEEE Trans. on Software Engineering, 2014,40(10):993-1006.[doi:10.1109/TSE.2014.2340398]
    [49] Padmanabhuni BM, Tan HBK. Predicting buffer overflow vulnerabilities through mining light-weight static code attributes. In:Proc. of the 2014 IEEE Int'l Symp. on Software Reliability Engineering Workshops. IEEE, 2014. 317-322.[doi:10.1109/ISSREW. 2014.26]
    [50] Pang Y, Xue X, Wang H. Predicting vulnerable software components through deep neural network. In:Proc. of the 2017 Int'l Conf. on Deep Learning Technologies. ACM, 2017. 6-10.[doi:10.1145/3094243.3094245]
    [51] Chernis B, Verma R. Machine learning methods for software vulnerability detection. In:Proc. of the 4th ACM Int'l Workshop on Security and Privacy Analytics. ACM, 2018. 31-39.[doi:https://doi.org/10.1145/3180445.3180453]
    [52] Russell R, Kim L, Hamilton L, Lazovich T, Harer J, Ozdemir O, Ellingwood P, McConley M. Automated vulnerability detection in source code using deep representation learning. In:Proc. of the 17th IEEE Int'l Conf. on Machine Learning and Applications (ICMLA). 2018. 757-762.[doi:10.1109/ICMLA.2018.00120]
    [53] Li Z, Zou DQ, Wang ZL, Jin H. Survey on static software vulnerability detection for source code. Chinese Journal of Network and Information Security, 2019,5(1):5-18(in Chinese with English abstract).[doi:10.119590.issn.2096-109x.2019001]
    [54] Zou D, Wang S, Xu S, Li Z, Jin H. μVulDeePecker:A deep learning-based system for multiclass vulnerability detection. IEEE Trans. on Dependable and Secure Computing, 2019. 1.[doi:10.1109/TDSC.2019.2942930]
    [55] Zuo F, Li X, Young P, Luo L, Zeng Q, Zhang Z. Neural machine translation inspired binary code similarity comparison beyond function pairs. In:Proc. of the Network and Distributed Systems Security (NDSS) Symp. 2019.[doi:https://dx.doi.org/10.14722/ndss.2019.23492]
    [56] Wu F, Wang J, Liu J, Wang W. Vulnerability detection with deep learning. In:Proc. of the 3rd IEEE Int'l Conf. on Computer and Communications (ICCC). 2017. 1298-1302.
    [57] Grieco G, Grinblat GL, Uzal L, Rawat S, Feist J, Mounier L. Toward large-scale vulnerability discovery using machine learning. In:Proc. of the ACM Conf. on Data & Application Security & Privacy. 2016.[doi:http://dx.doi.org/10.1145/2857705.2857720]
    [58] Shen Y, Mariconti E, Vervier PA, Stringhini G. Tiresias:Predicting security events through deep learning. In:Proc. of the 2018 ACM SIGSAC Conf. on Computer and Communications Security. ACM, 2018. 592-605.[doi:https://doi.org/10.1145/3243734. 3243811]
    [59] Zhu B, Zheng H, Sun LL, Yang YX. Research on similarity measure for ast-based program codes. Journal of Jilin University, 2015, 33(1):99-104(in Chinese with English abstract).[doi:10.3969/j.issn.1671-5896.2015.01.016]
    [60] Yamaguchi F, Lottmann M, Rieck K. Generalized vulnerability extrapolation using abstract syntax trees. In:Proc. of the Computer Security Applications Conf. 2012.[doi:10.1145/2420950.2421003]
    [61] Lin G, Zhang J, Wei L, Lei P, Yang X. POSTER:Vulnerability discovery with function representation learning from unlabeled projects. In:Proc. of the ACM SIGSAC Conf. 2017.[doi:https://doi.org/http://dx.doi.org/10.1145/3133956.3138840]
    [62] Medeiros I, Neves NF, Correia M. Automatic detection and correction of Web application vulnerabilities using data mining to predict false positives. In:Proc. of the Int'l Conf. on World Wide Web. 2014.[doi:http://dx.doi.org/10.1145/2566486.2568024]
    [63] Kratkiewicz KJ. Evaluating static analysis tools for detecting buffer overflows in C code[MS. Thesis]. Cambridge:Harvard University, 2005.
    [64] Mou L, Ge L, Zhi J, Lu Z, Tao W. Convolutional neural network over tree structures for programming language processing. In:Proc. of the 30th AAAI Conf. on Artificial Intelligence. 2016.[doi:10.13140/RG.2.1.2912.2966]
    [65] Anbiya DR, Purwarianti A, Asnar Y. Vulnerability detection in php Web application using lexical analysis approach with machine learning. In:Proc. of the 5th Int'l Conf. on Data and Software Engineering (ICoDSE). IEEE, 2018. 1-6.
    [66] Peng S, Liu P, Han J. A python security analysis framework in integrity verification and vulnerability detection. Wuhan University Journal of Natural Sciences, 2019,24(2):141-148.[doi:https://doi.org/10.1007/s11859-019-1379-5]
    [67] Liu YL. Token-Based structured code matching homology detection technology. Application Research of Computers, 2014,31(6):1841-1845(in Chinese with English abstract).[doi:10.3969/j.issn.1001-3695.2014.06.057]
    [68] Cheng H, Lo D, Zhou Y, Wang X, Yan X. Identifying bug signatures using discriminative graph mining. In:Proc. of the 18th Int'l Symp. on Software Testing & Analysis. 2009.[doi:10.1145/1572272.1572290]
    [69] Nguyen H, Tran LMS. Predicting vulnerable software components with dependency graphs. 2013.[doi:10.1145/1853919. 1853923]
    [70] Yamaguchi F, Golde N, Arp D, Rieck K. Modeling and discovering vulnerabilities with code property graphs. In:Proc. of the Security & Privacy. 2014.[doi:10.1109/SP.2014.44]
    [71] Qian F, Zhou R, Xu C, Yao C, Testa B, Yin H. Scalable graph-based bug search for firmware images. In:Proc. of the ACM SIGSAC Conf. on Computer & Communications Security. 2016.[doi:http://dx.doi.org/10.1145/2976749.2978370]
    [72] Xu X, Liu C, Feng Q, Yin H, Song L, Song D. Neural network-based graph embedding for cross-platform binary code similarity detection. In:Proc. of the 2017 ACM SIGSAC Conf. on Computer and Communications Security. ACM, 2017. 363-376.[doi:http://dx.doi.org/10.1145/3133956.3134018]
    [73] Dai H, Dai B, Song L. Discriminative embeddings of latent variable models for structured data. In:Proc. of the Int'l Conf. on Machine Learning. 2016. 2702-2711.[doi:1603.05629]
    [74] Harer JA, Kim LY, Russell RL, Ozdemir O, Kosta LR, Rangamani A, Hamilton LH, Centeno GI, Key JR, Ellingwood PM, Antelman E, Mackay A, McConley MW, Opper JM, Chin P, Lazovich T. Automated software vulnerability detection with machine learning. CoRR, vol.abs/1803.04497, 2018.
    [75] Liu DJ, Li Y, Tang Y, Wang BS, Xie W. VMPBL:Identifying vulnerable functions based on machine learning combining patched information and binary comparison technique by LCS. In:Proc. of the 17th IEEE Int'l Conf. on Trust, Security and Privacy in Computing and Communications. 2018.[doi:10.1109/TrustCom/BigDataSE.2018.00114]
    [76] Walden J, Stuckman J, Scandariato R. Predicting vulnerable components:Software metrics vs text mining. In:Proc. of the 25th IEEE Int'l Symp. on Software Reliability Engineering. IEEE, 2014. 23-33.[doi:10.1109/ISSRE.2014.32]
    [77] Tang Y, Fei Z, Yang Y, Lu H, Xu B. Predicting vulnerable components via text mining or software metrics? An effort-aware perspective. In:Proc. of the IEEE Int'l Conf. on Software Quality. 2015.[doi:10.1109/QRS.2015.15]
    [78] Lessmann S, Baesens B, Mues C, Pietsch S. Benchmarking classification models for software defect prediction:A proposed framework and novel findings. IEEE Trans. on Software Engineering, 2008,34(4):485-496.[doi:10.1109/TSE.2008.35]
    [79] Ghotra B, McIntosh S, Hassan AE. Revisiting the impact of classification techniques on the performance of defect prediction models. In:Proc. of the 37th Int'l Conf. on Software Engineering, Vol.1. Piscataway:IEEE, 2015. 789-800.[doi:10.1109/ICSE. 2015.91]
    [80] Abunadi I, Alenezi M. Towards cross project vulnerability prediction in open source Web applications. In:Proc. of the Int'l Conf. on Engineering & Mis. 2015.[doi:http://dx.doi.org/10.1145/2832987.2833051]
    [81] Ying M. Transfer learning for cross-company software defect prediction. Information & Software Technology, 2012,54(3):248.[doi:10.1016/j.infsof.2011.09.007]
    [82] Moshtari S, Sami A. Evaluating and comparing complexity, coupling and a new proposed set of coupling metrics in cross-project vulnerability prediction. In:Proc. of the ACM Symp. on Applied Computing. 2016.[doi:http://dx.doi.org/10.1145/2851613.2851777]
    [83] Shin Y, Meneely A, Williams L, Osborne JA. Evaluating complexity, code churn, and developer activity metrics as indicators of software vulnerabilities. IEEE Trans. on Software Engineering, 2011,37(6):772-787.[doi:10.1109/TSE.2010.81]
    [84] Dong Y, Guo W, Chen Y, Xing X, Zhang Y, Wang G. Towards the detection of inconsistencies in public security vulnerability reports. In:Proc. of the 28th USENIX Security Symp. (USENIX Security 2019). 2019. 869-885. https://www.usenix.org/conference/usenixsecurity19/presentation/dong
    [85] Jimenez M, Rwemalika R, Papadakis M, Sarro F, Le Traon Y, Harman M. The importance of accounting for real-world labelling when predicting software vulnerabilities. In:Proc. of the Joint European Software Engineering Conf. and Symp. on the Foundations of Software Engineering (ESEC/FSE). 2019.[doi:https://doi.org/10.1145/3338906.3338941]
    [86] Anderson C. The long tail:Why the future of business is selling less of more. In:Hachette Books. 2006.
    [87] Chen Y, Xing L, Qin Y, Liao X, Wang X, Chen K, Zou W. Devils in the guidance:Predicting logic vulnerabilities in payment syndication services through automated documentation analysis. In:Proc. of the 28th USENIX Security Symp. (USENIX Security 2019). 2019. 747-764. https://www.usenix.org/conference/usenixsecurity19/presentation/chen-yi
    [88] Ban X, Liu S, Chen C, Chua C. A performance evaluation of deep-learnt features for software vulnerability detection. In:Proc. of the Concurrency and Computation:Practice and Experience, 2019. e5103.[doi:10.1002/cpe.5103]
    [89] Jian S, Pang G, Cao L, Lu K, Gao H. Cure:Flexible categorical data representation by hierarchical coupling learning. IEEE Trans. on Knowledge and Data Engineering, 2018,31(5):853-866.[doi:10.1109/TKDE.2018.2848902]
    [90] Votipka D, Stevens R, Redmiles E, Hu J, Mazurek ML. Hackers vs. testers:A comparison of software vulnerability discovery processes. In:Proc. of the 2018 IEEE Symp. on Security and Privacy (SP). 2018.[doi:10.1109/SP.2018.00003]
    [91] Chen H, Liu R, Park N, Subrahmanian V. Using Twitter to predict when vulnerabilities will be exploited. In:Proc. of the 25th ACM SIGKDD Int'l Conf. on Knowledge Discovery & Data Mining. ACM, 2019. 3143-3152.[doi:https://doi.org/10.1145/3292500.3330742]
    [92] Xu J, Zhang QZ, Zhao X, Lv P, Li TS. Survey on dynamic graph pattern matching technologies. Ruan Jian Xue Bao/Journal of Software, 2018,29(3):663-688(in Chinese with English abstract). http://www.jos.org.cn/1000-9825/5444.htm[doi:10.13328/j. cnki.jos.005444]
    [93] Chen X, Gu Q, Liu WS, Liu SL, Ni C. Survey of static software defect prediction. Ruan Jian Xue Bao/Journal of Software, 2016, 27(10):1-25(in Chinese with English abstract). http://www.jos.org.cn/1000-9825/4923.htm[doi:10.13328/j.cnki.jos.004923]
    [94] Chen X, Wang LP, Gu Q, Wang Z, Ni C, Liu WS, Wang QP. A survey on cross-project software defect prediction methods. Chinese Journal of Computers, 2018, 41(1):254-274(in Chinese with English abstract).[doi:10.11897/SP.J.1016.2018.00254]
    附中文参考文献:
    [1] 中华人民共和国工业和信息化部.2018. http://www.miit.gov.cn/
    [4] 吴世忠.信息安全漏洞分析回顾与展望.清华大学学报(自然科学版),2009,49(S2):2065-2072.[doi:10.16511/j.cnki.qhdxxb.2009. s2.005]
    [5] 吴世忠,郭涛,董国伟,王嘉捷.软件漏洞分析技术进展.清华大学学报(自然科学版),2012,52(10):1309-1319.[doi:10.16511/j.cnki. qhdxxb.2012.10.001]
    [15] 宋丛溪,王辛,张文喆.Angr动态软件测试应用分析与优化.计算机工程与科学,2018,40(z1):163-168.[doi:10.3969/j.issn.1007-130X.2018.Suppl(1).030]
    [21] 张雄,李舟军.模糊测试技术研究综述.计算机科学,2016,43(5):1-8.[doi:10.11896/j.issn.1002-137X.2016.5.001]
    [22] 叶志斌,严波.符号执行研究综述.计算机科学,2018,45(s1):28-35.[doi:CNKI:SUN:JSJA.0.2018-S1-006]
    [23] 邹权臣,张涛,吴润浦,马金鑫,李美聪,陈晨,侯长玉.从自动化到智能化:软件漏洞挖掘技术进展.清华大学学报(科学与技术), 2018,58(12):45-60.[doi:10.16511/j.cnki.qhdxxb.2018.21.025]
    [25] 孙鸿宇,何远,王基策,董颖,朱立鹏,王鹤,张玉清.人工智能技术在安全漏洞领域的应用.通信学报,2018,39(8):1-17.[doi:10.11959/j.issn.1000-436x.2018137]
    [43] 王飞雪,李芳.基于激活漏洞能力条件的软件漏洞自动分类框架.重庆理工大学学报(自然科学),2019,5:154-160.[doi:10.3969/j. issn.1674-8425(z).2019.05.025]
    [53] 李珍,邹德清,王泽丽,金海.面向源代码的软件漏洞静态检测综述.网络与信息安全学报,2019,5(1):5-18.[doi:10.119590.issn. 2096-109x.2019001]
    [59] 朱波,郑虹,孙琳琳,杨友星.基于AST的程序代码相似性度量研究.吉林大学学报(信息科学版),2015,33(1):99-104.[doi:10.3969/j.issn.1671-5896.2015.01.016]
    [67] 刘云龙.基于Token的结构化匹配同源性代码检测技术研究.计算机应用研究,2014,31(6):1841-1845.[doi:10.3969/j.issn.1001-3695.2014.06.057]
    [92] 许嘉,张千桢,赵翔,吕品,李陶深.动态图模式匹配技术综述.软件学报,2018,29(3):663-688. http://www.jos.org.cn/1000-9825/5444.htm[doi:10.13328/j.cnki.jos.005444]
    [93] 陈翔,顾庆,刘望舒,刘树龙,倪超.静态软件缺陷预测方法研究.软件学报,2016,27(1):1-25. http://www.jos.org.cn/1000-9825/4923.htm[doi:10.13328/j.cnki.jos.004923]
    [94] 陈翔,王莉萍,顾庆,王赞,倪超,刘望舒,王秋萍.跨项目软件缺陷预测方法研究综述.计算机学报,2018,41(1):254-274.[doi:10.11897/SP.J.1016.2018.00254]
    引证文献
    网友评论
    网友评论
    分享到微博
    发 布
引用本文

李韵,黄辰林,王中锋,袁露,王晓川.基于机器学习的软件漏洞挖掘方法综述.软件学报,2020,31(7):2040-2061

复制
分享
文章指标
  • 点击次数:6523
  • 下载次数: 16907
  • HTML阅读次数: 6670
  • 引用次数: 0
历史
  • 收稿日期:2019-11-08
  • 最后修改日期:2020-02-07
  • 在线发布日期: 2020-05-26
  • 出版日期: 2020-07-06
文章二维码
友情链接:中国科学院软件研究所中国计算机学会中国科学院国家自然科学基金委员会CCF数字图书馆Int'l J of Softw Info计算机系统应用
您是第19730566位访问者
版权所有：中国科学院软件研究所 京ICP备05046678号-3
地址：北京市海淀区中关村南四街4号,邮政编码：100190
电话：010-62562563 传真：010-62562533 Email：jos@iscas.ac.cn
技术支持：北京勤云科技发展有限公司

京公网安备 11040202500063号