基于函数间结构特征关联的软件漏洞检测方法
CSTR:
作者:
作者单位:

作者简介:

通讯作者:

黄琼,E-mail:qhuang@scau.edu.cn

中图分类号:

TP311

基金项目:

国家自然科学基金(62272174);广东省基础与应用基础研究基金(2022A1515110564);广州市智慧农业重点实验室项目(201902010081)


Software Vulnerability Detection Based on Correlation of Structural Features between Functions
Author:
Affiliation:

Fund Project:

  • 摘要
  • |
  • 图/表
  • |
  • 访问统计
  • |
  • 参考文献
  • |
  • 相似文献
  • |
  • 引证文献
  • |
  • 资源附件
  • |
  • 文章评论
    摘要:

    漏洞检测是软件系统安全领域的关键技术. 近年来, 深度学习凭借其代码特征提取的卓越能力, 在漏洞检测领域取得了显著进展. 然而, 当前基于深度学习的方法仅关注于代码实例自身的独立结构特征, 而忽视了不同漏洞代码间存在的结构特征相似关联, 限制了漏洞检测技术的性能. 针对这一问题, 本文提出了一种基于函数间结构特征关联的软件漏洞检测方法(CSFF-VD). 该方法首先将函数解析为代码属性图, 并通过门控图神经网络提取函数内的独立结构特征. 在此基础之上, 利用特征之间的相似性构建函数间的关联网络并构建基于图注意力网络进一步提取函数间关联信息, 以此提升漏洞检测的性能. 实验结果显示, CSFF-VD在三个公开的漏洞检测数据集上超过了当前基于深度学习的漏洞检测方法. 此外, 本文在函数内各独立特征提取的基础上, 通过增加CSFF-VD中函数间关联特征提取方法的实验, 证明了集成函数间关联信息的有效性.

    Abstract:

    Vulnerability detection is a critical technology in software system security. In recent years, deep learning has made significant advances in vulnerability detection due to its exceptionals capability in code feature extraction. However, current deep learning-based approaches focus solely on the independent structural features of code instances, neglecting the structural feature similarities and associations among different vulnerable codes, which limits the performance of vulnerability detection technology. To address this issue, this paper proposes a vulnerability detection method based on the correlation of structural features between functions (CSFF-VD). This method first parses functions into code property graphs and extracts independent structural features within functions using gated graph neural networks. On this basis, it constructs an association network among functions using feature similarity and employs a graph attention network to further extract structural similarity information between functions, thereby enhancing vulnerability detection performance. Experimental results show that CSFF-VD outperforms current deep learning-based vulnerability detection methods on three public vulnerability detection datasets. In addition, based on the extraction of independent features within the function, this paper proves the effectiveness of integrating the correlation information between functions by adding experiments on the inter-function correlation feature extraction method in CSFF-VD.

    参考文献
    相似文献
    引证文献
引用本文

邱少健,程嘉濠,黄梦阳,黄琼.基于函数间结构特征关联的软件漏洞检测方法.软件学报,2025,36(7):0

复制
分享
文章指标
  • 点击次数:
  • 下载次数:
  • HTML阅读次数:
  • 引用次数:
历史
  • 收稿日期:2024-08-26
  • 最后修改日期:2024-10-15
  • 录用日期:
  • 在线发布日期: 2024-12-10
  • 出版日期:
文章二维码
您是第位访问者
版权所有:中国科学院软件研究所 京ICP备05046678号-3
地址:北京市海淀区中关村南四街4号,邮政编码:100190
电话:010-62562563 传真:010-62562533 Email:jos@iscas.ac.cn
技术支持:北京勤云科技发展有限公司

京公网安备 11040202500063号