Automated Software Vulnerability Detection Based on Hybrid Neural Network
Vulnerabilities threaten the security of information systems. It is crucial to detect and patch vulnerabilities before attacks happen. However, existing vulnerability detection methods suffer from long-term dependency, out of vocabulary, bias towards global features or local features, and coarse det...
| Main Authors: | , , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2021-04-01
|
| Series: | Applied Sciences |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2076-3417/11/7/3201 |
| _version_ | 1827695985657118720 |
|---|---|
| author | Xin Li Lu Wang Yang Xin Yixian Yang Qifeng Tang Yuling Chen |
| author_facet | Xin Li Lu Wang Yang Xin Yixian Yang Qifeng Tang Yuling Chen |
| author_sort | Xin Li |
| collection | DOAJ |
| description | Vulnerabilities threaten the security of information systems. It is crucial to detect and patch vulnerabilities before attacks happen. However, existing vulnerability detection methods suffer from long-term dependency, out of vocabulary, bias towards global features or local features, and coarse detection granularity. This paper proposes an automatic vulnerability detection framework in source code based on a hybrid neural network. First, the inputs are transformed into an intermediate representation with explicit structure information using lower level virtual machine intermediate representation (LLVM IR) and backward program slicing. After the transformation, the size of samples and the size of vocabulary are significantly reduced. A hybrid neural network model is then applied to extract high-level features of vulnerability, which learns features both from convolutional neural networks (CNNs) and recurrent neural networks (RNNs). The former is applied to learn local vulnerability features, such as buffer size. Furthermore, the latter is utilized to learn global features, such as data dependency. The extracted features are made up of concatenated outputs of CNN and RNN. Experiments are performed to validate our vulnerability detection method. The results show that our proposed method achieves excellent results with F1-scores of 98.6% and accuracy of 99.0% on the SARD dataset. It outperforms state-of-the-art methods. |
| first_indexed | 2024-03-10T12:38:36Z |
| format | Article |
| id | doaj.art-5aa96e269ac04ba0b255b0222e82ecce |
| institution | Directory Open Access Journal |
| issn | 2076-3417 |
| language | English |
| last_indexed | 2024-03-10T12:38:36Z |
| publishDate | 2021-04-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Applied Sciences |
| spelling | doaj.art-5aa96e269ac04ba0b255b0222e82ecce2023-11-21T14:03:37ZengMDPI AGApplied Sciences2076-34172021-04-01117320110.3390/app11073201Automated Software Vulnerability Detection Based on Hybrid Neural NetworkXin Li0Lu Wang1Yang Xin2Yixian Yang3Qifeng Tang4Yuling Chen5School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing 100876, ChinaSchool of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing 100876, ChinaSchool of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing 100876, ChinaSchool of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing 100876, ChinaNational Engineering Laboratory for Big Data Distribution and Exchange Technologies, Shanghai Data Exchange Corporation, Shanghai 200436, ChinaState Key Laboratory of Public Big Data, College of Computer Science and Technology, Guizhou University, Guiyang 550025, ChinaVulnerabilities threaten the security of information systems. It is crucial to detect and patch vulnerabilities before attacks happen. However, existing vulnerability detection methods suffer from long-term dependency, out of vocabulary, bias towards global features or local features, and coarse detection granularity. This paper proposes an automatic vulnerability detection framework in source code based on a hybrid neural network. First, the inputs are transformed into an intermediate representation with explicit structure information using lower level virtual machine intermediate representation (LLVM IR) and backward program slicing. After the transformation, the size of samples and the size of vocabulary are significantly reduced. A hybrid neural network model is then applied to extract high-level features of vulnerability, which learns features both from convolutional neural networks (CNNs) and recurrent neural networks (RNNs). The former is applied to learn local vulnerability features, such as buffer size. Furthermore, the latter is utilized to learn global features, such as data dependency. The extracted features are made up of concatenated outputs of CNN and RNN. Experiments are performed to validate our vulnerability detection method. The results show that our proposed method achieves excellent results with F1-scores of 98.6% and accuracy of 99.0% on the SARD dataset. It outperforms state-of-the-art methods.https://www.mdpi.com/2076-3417/11/7/3201cyber securityvulnerability detectionprogram slicestatic analysis |
| spellingShingle | Xin Li Lu Wang Yang Xin Yixian Yang Qifeng Tang Yuling Chen Automated Software Vulnerability Detection Based on Hybrid Neural Network Applied Sciences cyber security vulnerability detection program slice static analysis |
| title | Automated Software Vulnerability Detection Based on Hybrid Neural Network |
| title_full | Automated Software Vulnerability Detection Based on Hybrid Neural Network |
| title_fullStr | Automated Software Vulnerability Detection Based on Hybrid Neural Network |
| title_full_unstemmed | Automated Software Vulnerability Detection Based on Hybrid Neural Network |
| title_short | Automated Software Vulnerability Detection Based on Hybrid Neural Network |
| title_sort | automated software vulnerability detection based on hybrid neural network |
| topic | cyber security vulnerability detection program slice static analysis |
| url | https://www.mdpi.com/2076-3417/11/7/3201 |
| work_keys_str_mv | AT xinli automatedsoftwarevulnerabilitydetectionbasedonhybridneuralnetwork AT luwang automatedsoftwarevulnerabilitydetectionbasedonhybridneuralnetwork AT yangxin automatedsoftwarevulnerabilitydetectionbasedonhybridneuralnetwork AT yixianyang automatedsoftwarevulnerabilitydetectionbasedonhybridneuralnetwork AT qifengtang automatedsoftwarevulnerabilitydetectionbasedonhybridneuralnetwork AT yulingchen automatedsoftwarevulnerabilitydetectionbasedonhybridneuralnetwork |