HCRVD: A Vulnerability Detection System Based on CST-PDG Hierarchical Code Representation Learning
Source abstract
Abstract
Prior studies have demonstrated that deep learning-based approaches can enhance the performance of source code vulnerability detection by training neural networks to learn vulnerability patterns in code representations. However, due to limitations in code representation and neural network design, the validity and practicality of the model still need to be improved. Additionally, due to differences in programming languages, most methods lack cross-language detection generality. To address these issues, in this paper, we analyze the shortcomings of previous code representations and neural networks. We propose a novel hierarchical code representation that combines Concrete Syntax Trees (CST) with Program Dependence Graphs (PDG). Furthermore, we introduce a Tree-Graph-Gated-Attention (TGGA) network based on gated recurrent units and attention mechanisms to build a Hierarchical Code Representation learning-based Vulnerability Detection (HCRVD) system. This system enables cross-language vulnerability detection at the function-level. The experiments show that HCRVD surpasses many competitors in vulnerability detection capabilities. It benefits from the hierarchical code representation learning method, and outperforms baseline in cross-language vulnerability detection by 9.772% and 11.819% in the C/C++ and Java datasets, respectively. Moreover, HCRVD has certain ability to detect vulnerabilities in unknown programming languages and is useful in real open-source projects. HCRVD shows good validity, generality and practicality.
Source: openalex_inverted_index · Quality: baseline
Research context
OpenAlex topics: Software Engineering Research · Advanced Malware Detection Techniques · Software Reliability and Analysis Research
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
References (47)
Show source-provided references
1. Synopsys.com, “Open-source security and analysis report,” Accessed: Oct. 18, 2023. [Online]. Available: https://www.synopsys.com/software-integrity/resources/analyst-reports/open-source-security-risk-analysis.html
2. “Flawfinder,” Accessed: Oct. 18, 2023. [Online]. Available: https://dwheeler.com/flawfinder/
3. “Clang static analyzer,” Accessed: Oct. 18, 2023. [Online]. Available: https://clang-analyzer.llvm.org/
4. “Application security testing company, Checkmarx,” Accessed: Oct. 18, 2023. [Online]. Available: https://checkmarx.com/
5. “Fortify,” Accessed: Oct. 18, 2023. [Online]. Available: https://www.microfocus.com/en-us/cyberres/application-security
6. VUDDY: A scalable approach for vulnerable code clone discovery
7. Y. Xiao et al., “MVP: Detecting vulnerabilities using patch-enhanced vulnerability signatures,” presented at the 29th USENIX Secur. Symp. (USENIX Security 20), 2020, pp. 1165–1182.
8. VDSimilar: Vulnerability detection based on code similarity of vulnerabilities and patches10.1016/j.cose.2021.102417 ↗
9. Automated vulnerability detection in source code using deep representation learning
10. Automated vulnerability detection in source code using minimum intermediate representation learning10.3390/app10051692 ↗
11. VUDENC: Vulnerability detection with deep learning on a natural codebase for python10.1016/j.infsof.2021.106809 ↗
12. VulDeePecker: A deep learning-based system for vulnerability detection
13. μVulDeePecker: A deep learning-based system for multiclass vulnerability detection
14. SySeVR: A framework for using deep learning to detect software vulnerabilities10.1109/TDSC.2021.3051525 ↗
15. Devign: Effective vulnerability identification by learning comprehensive program semantics via graph neural networks
16. Combining graph-based learning with automated data collection for code vulnerability detection10.1109/TIFS.2020.3044773 ↗
17. DeepWukong: Statically detecting software vulnerabilities using deep graph neural network10.1145/3436877 ↗
18. CSGVD: A deep learning approach combining sequence and graph embedding for source code vulnerability detection10.1016/j.jss.2023.111623 ↗
19. LineVD: Statement-level vulnerability detection using graph neural networks
20. Transformer-based language models for software vulnerability detection
21. BGNN4VD: Constructing bidirectional graph neural-network for vulnerability detection10.1016/j.infsof.2021.106576 ↗
22. Deep learning based vulnerability detection: Are we there yet?10.1109/TSE.2021.3087402 ↗
23. Li · Web Information Systems and Applications, Lecture Notes in Computer Science · 2023 · 35910.1007/978-981-99-6222-8_30 ↗
24. Y. Mirsky et al., “VulChecker: Graph-based vulnerability localization in source code,” presented at the 32th USENIX Secur. Symp. (USENIX Security 23), 2023.
25. VulCNN: An image-inspired scalable vulnerability detection system
26. Automatic identification of vulnerable code: Investigations with an AST-based neural network
27. CPVD: Cross project vulnerability detection based on graph attention network and domain adaptation10.1109/TSE.2023.3285910 ↗
28. N. T. Islam, G. D. L. T. Parra, D. Manuel, E. Bou-Harb, and P. Najafirad, “An unbiased transformer source code learning with semantic vulnerability graph,” Accessed: Jan. 02, 2024. [Online]. Available: https://arxiv.org/abs/2304.11072v1
29. SARD, “NIST software assurance reference dataset,” Accessed: Oct. 18, 2023. [Online]. Available: https://samate.nist.gov/SRD/index.php
30. Nvd.nist.gov, “National vulnerability database,” Accessed: Oct. 18, 2023. [Online]. Available: https://nvd.nist.gov
31. VulBERTa: Simplified source code pre-training for vulnerability detection
32. An empirical study of text-based machine learning models for vulnerability detection10.1007/s10664-022-10276-6 ↗
33. Devlin · Proc. 2019 Conf. North American Chapter Assoc. Comput. Linguist.: Hum. Lang. Technol. · 2019 · 1 · 417110.18653/v1/N19-1423 ↗
34. Zhuang · Proc. 20th Chinese National Conf. Computat. Linguist. · 2021 · 1218
35. VulDeeLocator: A deep learning-based fine-grained vulnerability detector10.1109/TDSC.2021.3076142 ↗
36. Interpreters for GNN-based vulnerability detection: Are we there yet?
37. Cross-domain vulnerability detection using graph embedding and domain adaptation10.1016/j.cose.2022.103017 ↗
38. Novel neural source code representation based on abstract syntax tree
39. J. Chung, C. Gulcehre, K. Cho, and Y. Bengio, “Empirical evaluation of gated recurrent neural networks on sequence modeling,” 2014. doi: 10.48550/arXiv.1412.3555.
40. Attention is all you need
41. Learning long-term dependencies with gradient descent is difficult10.1109/72.279181 ↗
42. Graph neural networks with adaptive readouts
43. Y. Li, D. Tarlow, M. Brockschmidt, and R. Zemel, “Gated graph sequence neural networks,” 2015. doi: 10.48550/arXiv.1511.05493.
44. “Joern–The bug hunter’s workbench,” Accessed: Oct. 18, 2023. [Online]. Available: http://joern.io
45. Modeling and discovering vulnerabilities with code property graphs
46. VulDetector: Detecting vulnerabilities using weighted feature graph comparison10.1109/TIFS.2020.3047756 ↗
47. “Tree-sitter,” Accessed: Oct. 18, 2023. [Online]. Available: https://tree-sitter.github.io