.png){kind=icon}
返回
Securing Code With Context: Enhancing Vulnerability Detection Through Contextualized Graph Representations
.png){kind=icon}
OA
AI
DOI：10.1109/ACCESS.2024.3467180.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Detecting source code vulnerabilities is a critical challenge in secure software development. Early identification of vulnerabilities ensures that software performance and security remain uncompromised. However, existing vulnerability detection methods often struggle to capture the semantic meaning of source code, particularly for vulnerability types that require a deeper understanding of code flow and context. This work addresses this challenge by introducing ContextCPG, a novel enhancement of the code property graph (CPG) representation. ContextCPG augments the CPG by incorporating additional information about variable names and data types within the source code. Our approach combines natural language processing analysis with graph-based analysis to capture a richer context surrounding the source code, relying on both the structural features of the graph representation and the naming, type, and value of nodes as natural language analysis. These additional features enhance the capability of graph neural network models to capture the semantic meaning of the source code and better detect vulnerabilities. We evaluate ContextCPG by applying it to three selected C/C++ vulnerabilities (buffer overflow, invalid input, and use-after-free) and comparing its performance against CPGs. The evaluation results reveal that ContextCPG consistently outperforms the CPG on all vulnerability types, demonstrating an average accuracy increase of 8%. ContextCPG showcases the value of providing supplementary information within the graph representation, consistently enhancing vulnerability detection efficacy.
Keyword:
Vulnerability detection
code property graph
source code representation
graph neural network
Vulnerability detection
code property graph
source code representation
graph neural network
期刊
IF:
3.6
论文数:
9.8W
被引数:
29.4W
机构
引用论文
.png){kind=icon}
VulDeeLocator: A Deep Learning-Based Fine-Grained Vulnerability DetectorVulDeeLocator: 一种基于深度学习的细粒度漏洞检测器
OAAI
OAAI分享收藏SySeVR: A Framework for Using Deep Learning to Detect Software VulnerabilitiesSySeVR: 使用深度学习检测软件漏洞的框架OAAI
OAAI分享收藏分享收藏
查看更多内容