.png){kind=icon}
返回
VULDEFF: Vulnerability detection method based on function fingerprints and code differences
.png){kind=icon}
PRE
AI
DOI：10.1016/j.knosys.2022.110139.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
The significant increase in Open Source Software has led to a sharp increase in code cloning vulnerabilities. Code similarity detection methods are usually used to detect these vulnerabilities. However, cloned code often modifies the original code to varying degrees, and the difference between vulnerable code and patch code can be very small. Traditional code similarity detection methods cannot effectively detect common mutation patterns in code cloning and distinguish vulnerable code from patch code. The paper proposes a vulnerability detection method named VULDEFF based on function fingerprints and code differences. This paper designs a lightweight function fingerprint method based on the Context Triggered Piecewise Hashing algorithm, which can characterize the basic syntax features of function source code. In particular, the fingerprint of the vulnerable function contains the syntax features, vulnerability features, and patch features of the vulnerable function. VULDEFF detects whether target function has vulnerabilities by searching target function fingerprint in the vulnerable function fingerprint library. Compared with five advanced software vulnerability detection tools, VULDEFF significantly reduces the false positive and false negative rates while ensuring the scalability of vulnerability detection. VULDEFF discovered 111 new vulnerabilities in 10 open source projects.(c) 2022 Elsevier B.V. All rights reserved.
Keyword:
Open source software
Vulnerability detection
Code similarity detection
Function fingerprint
期刊
K
IF:
7.6
论文数:
1.2W
被引数:
4.5W
机构
引用论文
Controls on Sediment Suspension, Flux, and Marsh Deposition near a Bay-Marsh Boundary控制海湾-沼泽边界附近的沉积物悬浮，通量和沼泽沉积
PREAI
分享收藏CP-Miner: Finding copy-paste and related bugs in large-scale software codeCp-miner: 在大规模软件代码中查找复制粘贴和相关错误
PREAI
分享收藏
The crystal and molecular structure of UO2(NO3)2[Ph2P(O)CH2C(O)Ph]2 and its role in the solvent extraction of the uranyl ion.png)
Polyhedron
PolyhedronIF0
PREAI
分享收藏
查看更多内容