.png){kind=icon}
返回
Code-centric learning-based just-in-time vulnerability detection
.png){kind=icon}
OA
AI
DOI：10.1016/j.jss.2024.112014.png)
.png){kind=icon}
.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Attacks against computer systems exploiting software vulnerabilities can cause substantial damage to the cyber infrastructure of our modern society and economy. To minimize the consequences, it is vital to detect and fix vulnerabilities as soon as possible. Just -in -time vulnerability detection (JIT-VD) discovers vulnerability -prone (dangerous) commits to prevent them from being merged into source code and causing vulnerabilities. By JIT-VD, the commits' authors, who understand the commits properly, can review these dangerous commits and fix them if necessary while the relevant modifications are still fresh in their minds. In this paper, we propose CodeJIT , a novel graph -based code -centric learning -based approach for just -in -time vulnerability detection. The key idea of CodeJIT is that the meaning of the code changes of a commit is the direct and deciding factor for determining if the commit is dangerous for the code. Based on that idea, we design a novel graph -based representation, Code Transformation Graph (CTG) to represent the semantics of code changes in terms of both code syntactic structure and program dependencies. A graph neural network (GNN) model is developed to capture the meaning of the code changes represented by our graph -based representation and learn to discriminate between dangerous and safe commits. We conducted experiments to evaluate the JIT-VD performance of CodeJIT on a dataset of 20K+ dangerous and safe commits in 506 real -world projects from 1998 to 2022. Our results show that CodeJIT significantly improves the state-of-the-art JIT-VD methods by up to 66% in Recall, 136% in Precision, and 68% in F1. Moreover, CodeJIT correctly classifies nearly 9/10 of dangerous/safe (benign) commits and even detects 69 commits that fix a vulnerability yet produce other issues in source code.
Keyword:
Just-in-time vulnerability detection
Code-centric
Code change representation
Graph-based model
Commit-level bugs
AI总结
对已上传原文的论文进行重点信息的提取，主要内容包括：简要概述、研究摘要、背景介绍、关键亮点、图文解析、展望与总结。
期刊
IF:
4.1
论文数:
5.5K
被引数:
8.4K
机构
引用论文
CoreGen: Contextualized Code Representation Learning for Commit Message Generation.png)
NEUROCOMPUTINGOAAI
NEUROCOMPUTINGIF6.5
OAAI分享收藏Hemodynamic Exercise Response in Calves with an Implantable Biventricular Centrifugal Blood PumpOAAI
OAAI分享收藏分享收藏
查看更多内容