.png){kind=icon}
返回
HeVulD: A Static Vulnerability Detection Method Using Heterogeneous Graph Code Representation
.png){kind=icon}
PRE
AI
DOI：10.1109/TIFS.2024.3457162.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Vulnerability detection in source code has been a focal point of research in recent years. Traditional rule-based methods fail to identify complex and unknown vulnerabilities, leading to poor performance. While deep learning (DL)-based methods have improved these shortcomings, there is still room for enhancement. For C/C++ source code, effective vulnerability detection requires considering both the information in code statements and the structural information of the code. Graph-based code representation methods can address this need, but existing approaches often use homogeneous graphs that do not differentiate between various types of code statements or dependencies. Few methods use heterogeneous graphs for C/C++ code representation. This study explores this potential and proposes a new C/C++ vulnerability detection method named HeVulD. HeVulD introduces two node definition approaches and a key-node-based program slicing method, generating heterogeneous graph representations for source code. These representations consist of both heterogeneous nodes and edges, providing a more precise representation of source code. HeVulD achieves an F1-score of 96.4% on the SARD dataset, outperforming nine baseline C/C++ vulnerability detection methods. HeVulD has been tested under adversarial attack scenarios to assess its robustness. Additionally, HeVulD has been tested on ten open-source software projects and the latest CVEs, demonstrating its detection and generalization capabilities in real-world scenarios and its ability to identify unknown vulnerabilities.
Keyword:
Codes
Source coding
Software
Image edge detection
Syntactics
Semantics
Security
Software security
vulnerability detection
deep learning
program analysis
heterogeneous graph representation
期刊
IF:
8
论文数:
5.2K
被引数:
2.3W
机构
引用论文
.png){kind=icon}
VulDeeLocator: A Deep Learning-Based Fine-Grained Vulnerability DetectorVulDeeLocator: 一种基于深度学习的细粒度漏洞检测器
OAAI
OAAI分享收藏SySeVR: A Framework for Using Deep Learning to Detect Software VulnerabilitiesSySeVR: 使用深度学习检测软件漏洞的框架OAAI
OAAI分享收藏CPVD: Cross Project Vulnerability Detection Based on Graph Attention Network and Domain Adaptation
PREAI
分享收藏A systematic literature review on source code similarity measurement and clone detection: Techniques, applications, and challenges关于源代码相似性度量和克隆检测的系统文献综述: 技术，应用和挑战OAAI
OAAI分享收藏
查看更多内容