.png){kind=icon}
返回
Context-based statement-level vulnerability localization
.png){kind=icon}
PRE
AI
DOI：10.1016/j.infsof.2024.107406.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Context: The number of attacks exploring software vulnerabilities has dramatically increased, which has caused various severe damages. Thus, early and accurately detecting vulnerabilities becomes essential to guarantee software quality and prevent the systems from malicious attacks. Multiple automated vulnerability detection approaches have been proposed and obtained promising results. However, most studies detect vulnerabilities at a coarse -grained, i.e., file or method level. Thus, developers still have to spend significant investigation efforts on localizing vulnerable statements. Objective: In this paper, we introduce COSTA, a novel context -based approach to localize vulnerable statements. Method: In particular, given a vulnerable function, COSTA identifies vulnerable statements based on their suspiciousness scores. Specifically, the suspiciousness of each statement is measured according to its semantics captured by four contexts, including operation context, dependence context, surrounding context, and vulnerability type. Results: Our experimental results on a large vulnerability dataset show that COSTA outperforms the stateof-the-art approaches up to 96% in F1 -score and 167% in Accuracy. COSTA also surpasses these approaches up to two times in Top -1 Accuracy. Especially, COSTA obtains about 80% at Top -3 Recall. In other words, developers can find about 80% of the vulnerable statements by investigating only three first -ranked statements in each function. Conclusion: COSTA effectively addresses the challenge of statement -level vulnerability localization by leveraging multiple contextual features. Our experimental results show that COSTA outperforms existing state-ofthe-art approaches. With the ability to accurately and efficiently identify vulnerable statements, developers can better allocate their investigation efforts, reduce the risk of potential security threats, and ensure software quality and security in real -world applications.
Keyword:
Vulnerable statement
Vulnerability detection
Vulnerability localization
Context representation
COSTA
期刊
IF:
4.3
论文数:
3.8K
被引数:
7.7K
机构
引用论文
Hemodynamic Exercise Response in Calves with an Implantable Biventricular Centrifugal Blood Pump
OAAI
OAAI分享收藏Rationale and study design of the Adaptive study of IL-2 dose on regulatory T cells in type 1 diabetes (DILT1D): a non-randomised, open label, adaptive dose finding trial.png)
BMJ OpenOAAI
BMJ OpenIF0
OAAI分享收藏Cobalt and Copper Composite Oxides as Efficient Catalysts for Preferential Oxidation of CO in H2-Rich Stream钴和铜复合氧化物作为H2-Rich流中CO优先氧化的有效催化剂
PREAI
分享收藏Effect of alkalized urine on renal calculi in patients with gout: a protocol for a placebo-controlled, double-blinded randomized controlled trialTrials
OAAI
TrialsIF0
OAAI分享收藏
查看更多内容