面向深度漏洞检测模型的黑盒对抗攻击
CSTR:
作者:
作者单位:

作者简介:

通讯作者:

中图分类号:

TP311

基金项目:

国家自然科学基金(U23A20280, 62172350); 广东省基础与应用基础研究基金(2023A1515012846); 广西壮族自治区重点研发计划(2023AB29051); 江苏省“青蓝工程”中青年学术带头人培养项目; 南京大学软件新技术国家重点实验室开放项目(KFKT2022B10); 广西可信软件重点实验室 (kx202046); 南通市自然科学基金面上项目 (JC2023070)


Black-box Adversarial Attack for Deep Vulnerability Detection Model
Author:
Affiliation:

Fund Project:

  • 摘要
  • |
  • 图/表
  • |
  • 访问统计
  • |
  • 参考文献
  • |
  • 相似文献
  • |
  • 引证文献
  • |
  • 资源附件
  • |
  • 文章评论
    摘要:

    近年来, 基于深度学习的漏洞检测模型展示了令人印象深刻的漏洞检测能力. 通过对源代码的变量重命名实现扰动从而逃逸漏洞检测模型的对抗攻击已被广泛研究, 然而, 能否通过对源代码进行更多的扰动以提升对漏洞检测模型对抗攻击的效果并未被充分调研. 采用针对源代码的多种同义转换算子对其进行扰动, 并提出一种基于遗传算法的组合优化策略, 选择一组适应度最高的源代码同义转换算子, 以指导生成可以逃脱漏洞检测的对抗代码段. 在一个名为NonVulGen (无漏洞代码生成器, non vulnerability generator)的框架中实现了上述方法, 采用生成的对抗代码段对基于深度学习的漏洞检测模型进行评估. 考虑了最新提出的多种深度学习漏洞检测模型, 在攻击基于CodeBERT的漏洞检测模型时所提方法可以实现91.38%的平均攻击成功率, 在攻击基于GraphCodeBERT的漏洞检测模型时可以实现93.65%的平均攻击成功率, 以上结果相较于最先进的基线模型平均提升了28.94%和15.52%. 为了检验所提攻击方法的泛化能力, 攻击Devign、ReGVD和LineVul等常见漏洞检测模型, 平均攻击成功率分别为98.88%、97.85%和92.57%. 实验结果表明, 基于深度学习的漏洞检测模型无法有效区分由NonVulGen生成的对抗代码段. 进一步地, 基于训练数据生成的对抗代码段重训练漏洞检测模型, 在CodeBERT, GraphCodeBERT, Devign, ReGVD以及LineVul模型上攻击成功率均大幅度下降, 分别下降96.83%, 97.12%, 98.79%, 98.57%, 以及97.94%. 因此, 研究揭示基于深度学习漏洞检测模型存在亟待关注的对抗攻击问题并呼吁在发布漏洞检测模型之前做好模型加固工作.

    Abstract:

    In recent years, impressive capabilities have been demonstrated by deep learning-based vulnerability detection models in detecting vulnerabilities. Previous research has widely explored adversarial attacks using variable renaming to introduce disturbances in source code and evade detection. However, the effectiveness of introducing multiple disturbances through various transformation techniques in source code has not been adequately investigated. In this study, multiple synonymous transformation operators are applied to introduce disturbances in source code. A combination optimization strategy based on genetic algorithms is proposed, enabling the selection of source code transformation operators with the highest fitness to guide the generation of adversarial code segments capable of evading vulnerability detection. The proposed method is implemented in a framework named non-vulnerability generator (NonVulGen) and evaluated against deep learning-based vulnerability detection models. When applied to recently developed deep learning models, an average attack success rate of 91.38% is achieved against the CodeBERT-based model and 93.65% against the GraphCodeBERT-based model, representing improvements of 28.94% and 15.52% over state-of-the-art baselines, respectively. To assess the generalization ability of the proposed attack method, common models including Devign, ReGVD, and LineVul are targeted, achieving average success rates of 98.88%, 97.85%, and 92.57%, respectively. Experimental results indicate that adversarial code segments generated by NonVulGenx cannot be effectively distinguished by deep learning-based vulnerability detection models. Furthermore, significant reductions in attack success rates are observed after retraining the models with adversarial samples generated based on the training data, with a decrease of 96.83% for CodeBERT, 97.12% for GraphCodeBERT, 98.79% for Devign, 98.57% for ReGVD, and 97.94% for LineVul. These findings reveal the critical challenge of adversarial attacks in deep learning-based vulnerability detection models and highlight the necessity for model reinforcement before deployment.

    参考文献
    相似文献
    引证文献
引用本文

曲豫宾,黄松,陈翔,王兴亚,李龙,王丹,姚永明,鞠小林.面向深度漏洞检测模型的黑盒对抗攻击.软件学报,,():1-20

复制
相关视频

分享
文章指标
  • 点击次数:
  • 下载次数:
  • HTML阅读次数:
  • 引用次数:
历史
  • 收稿日期:2024-01-04
  • 最后修改日期:2024-07-24
  • 录用日期:
  • 在线发布日期: 2025-05-14
  • 出版日期:
文章二维码
您是第位访问者
版权所有:中国科学院软件研究所 京ICP备05046678号-3
地址:北京市海淀区中关村南四街4号,邮政编码:100190
电话:010-62562563 传真:010-62562533 Email:jos@iscas.ac.cn
技术支持:北京勤云科技发展有限公司

京公网安备 11040202500063号