Predicting vulnerability inducing function versions using node embeddings and graph neural networks

doi:10.1016/j.infsof.2022.106822

2022-05-01

PRE

Sefa Eren Şahin

Ecem Mine Özyedierler

Ayşe Tosun *

DOI：10.1016/j.infsof.2022.106822

原文链接

原文求助

摘要

En 中文

Context: Predicting software vulnerabilities over code changes is a difficult task due to obtaining real vulnerability data and their associated code fixes from software projects as software organizations are often reluctant to report those. Objective: We aim to propose a vulnerability prediction model that runs after every code change, and identifies vulnerability inducing functions in that version. We also would like to assess the success of node and token based source code representations over abstract syntax trees (ASTs) on predicting vulnerability inducing functions. Method: We train neural networks to represent node embeddings and token embeddings over ASTs in order to obtain feature representations. Then, we build two Graph Neural Networks (GNNs) with node embeddings, and compare them against Convolutional Neural Network (CNN) and Support Vector Machine (SVM) with token representations. Results: We report our empirical analysis over the change history of vulnerability inducing functions of Wireshark project. GraphSAGE model using source code representation via ASTs achieves the highest AUC rate, while CNN models using token representations achieves the highest recall, precision and F1 measure. Conclusion: Representing functions with their structural information extracted from ASTs, either in token form or in complete graph form, is great at predicting vulnerability inducing function versions. Transforming source code into token frequencies as a natural language text fails to build successful models for vulnerability prediction in a real software project.

Keyword:

Software vulnerabilities

Graph neural networks

Graph embeddings

Abstract syntax trees

期刊

Information and Software Technology

IF:

4.3

论文数:

3.8K

被引数:

7.7K

机构

Istanbul Technical University

学者数:

8.9K

论文数: 7.8K

被引数: 7.9K

引用论文

Impact of Metformin Use on Lactate Kinetics in Patients with Severe Sepsis and Septic Shock

Shock

IF0

2017-05-01

PREAI

Joongmin Park; Sung Yeon Hwang; Ik Joon Jo; Kyeongman Jeon; Gee Young Suh; Tae Rim Lee; Hee Yoon; Won Chul Cha; Min Seob Sim; Keumhee Chough Carriere; Seungmin Yeon; Tae Gun Shin

Data mining static code attributes to learn defect predictors 数据挖掘静态代码属性以学习缺陷预测器

IEEE TRANSACTIONS ON SOFTWARE ENGINEERING

IF5.6

2007-01-01

1.0K

PREAI

Menzies, Tim; Greenwald, Jeremy; Frank, Art

Mobility Practices and Gender Contracts: Changes in Gender Relations in Coastal Areas of Norway's High North

Nordic Journal on Law and Society

IF0

2017-09-26