.png){kind=icon}
返回
Deep Learning Based Vulnerability Detection: Are We There Yet?
.png){kind=icon}
OA
AI
DOI：10.1109/TSE.2021.3087402.png)
.png){kind=icon}
.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Automated detection of software vulnerabilities is a fundamental problem in software security. Existing program analysis techniques either suffer from high false positives or false negatives. Recent progress in Deep Learning (DL) has resulted in a surge of interest in applying DL for automated vulnerability detection. Several recent studies have demonstrated promising results achieving an accuracy of up to 95 percent at detecting vulnerabilities. In this paper, we ask, how well do the state-of-the-art DL-based techniques perform in a real-world vulnerability prediction scenario? To our surprise, we find that their performance drops by more than 50 percent. A systematic investigation of what causes such precipitous performance drop reveals that existing DL-based vulnerability prediction approaches suffer from challenges with the training data (e.g., data duplication, unrealistic distribution of vulnerable classes, etc.) and with the model choices (e.g., simple token-based models). As a result, these approaches often do not learn features related to the actual cause of the vulnerabilities. Instead, they learn unrelated artifacts from the dataset (e.g., specific variable/function names, etc.). Leveraging these empirical findings, we demonstrate how a more principled approach to data collection and model design, based on realistic settings of vulnerability prediction, can lead to better solutions. The resulting tools perform significantly better than the studied baseline-up to 33.57 percent boost in precision and 128.38 percent boost in recall compared to the best performing model in the literature. Overall, this paper elucidates existing DL-based vulnerability prediction systems' potential issues and draws a roadmap for future DL-based vulnerability prediction research.
Keyword:
Predictive models
Neural networks
Testing
Data models
Security
Training
Training data
Vulnerability
deep learning based vulnerability detection
real world vulnerabilities
graph neural network based vulnerability detection
AI总结
对已上传原文的论文进行重点信息的提取，主要内容包括：简要概述、研究摘要、背景介绍、关键亮点、图文解析、展望与总结。
期刊
IF:
5.6
论文数:
2.9K
被引数:
1.1W
机构
引用论文
Microscale forced combustion: Pyrolysis-combustion flow calorimetry (PCFC)微尺度强制燃烧: 热解-燃烧流量量热法 (PCFC)
PREAI
分享收藏Challenges and future of biomarker tests in the era of precision oncology: Can we rely on immunohistochemistry (IHC) or fluorescencein situhybridization (FISH) to select the optimal patients for matched therapy?.png)
OncotargetOAAI
OncotargetIF0
OAAI分享收藏分享收藏
查看更多内容