.png){kind=icon}
返回
MRC-VulLoc: Software source code vulnerability localization based on multi-choice reading comprehension
.png){kind=icon}
PRE
AI
DOI：10.1016/j.cose.2024.103816.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Recently, automatic vulnerability detection approaches based on machine learning (ML) have outperformed traditional rule -based approaches in terms of detection performance. Existing ML -based approaches typically concentrate on function or line granularity, which fail to realize accurate vulnerability localization and are insufficient to support effective root cause analysis of vulnerability. To address this issue, we propose a new approach that maps the multi -choice reading comprehension (MRC) task to the vulnerability localization task at the granularity of vulnerability triggering path named MRC-VulLoc. Initially, we design six large datasets (including C/C++ and Java languages) in the form of MRC. Subsequently, we introduce a novel pre -trained vulnerability localization model, combining the effective code semantic comprehension ability of pre -trained model with the advantages of Bidirectional Short -Term Memory Network (Bi-LSTM) and Convolutional Neural Network (CNN) models. Lastly, we conduct experiments to evaluate the vulnerability localization with several state-of-the-art MRC approaches and vulnerability detectors. Experimental results demonstrate the effectiveness of the proposed datasets in evaluating MRC approaches for vulnerability localization. Furthermore, MRC-VulLoc achieves higher precision on vulnerability localization compared to comparative vulnerability detectors.
Keyword:
Source code
Vulnerability localization
Machine learning
MRC
期刊
C
IF:
5.4
论文数:
4.6K
被引数:
1.4W
机构
引用论文
VulDeeLocator: A Deep Learning-Based Fine-Grained Vulnerability DetectorVulDeeLocator: 一种基于深度学习的细粒度漏洞检测器
OAAI
OAAI分享收藏SySeVR: A Framework for Using Deep Learning to Detect Software VulnerabilitiesSySeVR: 使用深度学习检测软件漏洞的框架OAAI
OAAI分享收藏A Study of Effects of Design Parameters on Transient Response and Injection Rate Shaping for a Common Rail Injector System设计参数对共轨喷油器系统瞬态响应和喷油率整形影响的研究
PREAI
分享收藏
VDSimilar: Vulnerability detection based on code similarity of vulnerabilities and patches.png)
COMPUTERS & SECURITY
COMPUTERS & SECURITYIF5.4
PREAI
分享收藏 没有更多内容
没有更多内容