<inline-formula><tex-math notation="LaTeX">$\mu$</tex-math><alternatives><mml:math><mml:mi>μ</mml:mi></mml:math><inline-graphic…

By Deqing Zou, Sujuan Wang, Shouhuai Xu, Zhen Li, Hai Jin. IEEE Transactions on Dependable and Secure Computing, 2019

341 citations recorded by the source corpus.

Fine-grained software vulnerability detection is an important and challenging problem. Ideally, a detection system (or detector) not only should be able to detect whether or not a program contains vulnerabilities, but also should be able to pinpoint the type of a vulnerability in question. Existing vulnerability detection methods based on deep learning can detect the presence of vulnerabilities (i.e., addressing the binary classification or detection problem), but cannot pinpoint types of vulnerabilities (i.e., incapable of addressing multiclass classification). In this paper, we propose the first deep learning-based system for multiclass vulnerability detection, dubbed <inline-formula><tex-math notation="LaTeX">$\mu$</tex-math><alternatives><mml:math><mml:mi>μ</mml:mi></mml:math><inline-graphic xlink:href="zou-ieq2-2942930.gif"/></alternatives></inline-formula>VulDeePecker. The key insight underlying <inline-formula><tex-math notation="LaTeX">$\mu$</tex-math><alternatives><mml:math><mml:mi>μ</mml:mi></mml:math><inline-graphic xlink:href="zou-ieq3-2942930.gif"/></alternatives></inline-formula>VulDeePecker is the concept of <italic>code attention</italic>, which can capture information that can help pinpoint types of vulnerabilities, even when the samples are small. For this purpose, we create a dataset from scratch and use it to evaluate the effectiveness of <inline-formula><tex-math notation="LaTeX">$\mu$</tex-math><alternatives><mml:math><mml:mi>μ</mml:mi></mml:math><inline-graphic xlink:href="zou-ieq4-2942930.gif"/></alternatives></inline-formula>VulDeePecker. Experimental results show that <inline-formula><tex-math notation="LaTeX">$\mu$</tex-math><alternatives><mml:math><mml:mi>μ</mml:mi></mml:math><inline-graphic xlink:href="zou-ieq5-2942930.gif"/></alternatives></inline-formula>VulDeePecker is effective for multiclass vulnerability detection and that accommodating control-dependence (other than data-dependence) can lead to higher detection capabilities.

Subfields: Information Systems, Software, Signal Processing

View Paper: https://www.semanticscholar.org/paper/badeafa6b025b5e3ab7cb1b07251628f015e138f

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

In Software

In Signal Processing

Citations in the corpus

SySeVR: A Framework for Using Deep Learning to Detect Software Vulnerabilities (2018, methodology): “VulDeePecker [11] is the ﬁrst system showing the feasibility of using deep learning to detect vulnerabilities while able to pin down locations of vulnerabilities.”
CVEfixes: automated collection of vulnerabilities and their fixes from open-source software (2021, methodology): “To address this challenge, 𝜇VulDeePeaker [4] and ManySStuBs4J [37] have constructed the multi-class vulnerability dataset.”
Software Vulnerability Detection Using Deep Neural Networks: A Survey (2020, methodology): “A recent study [127] further extended [56] by incorporating the “code gadget” to contain not only the code sequences depicting the relations of data dependences but also the code ones revealing the relations of control dependences.”
Deep Learning Based Vulnerability Detection: Are We There Yet? (2020, neutral): “detection shown very promising results in both static analysis [3], [4], [5], [6], [55], and dynamic analyses [62], [63], [74], symbolic executions [75].”