.png){kind=icon}
.png){kind=icon}
Return
A multitype software buffer overflow vulnerability prediction method based on a software graph structure and a self-attentive graph neural network
.png){kind=icon}
PRE
AI
DOI：10.1016/j.infsof.2023.107246.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Context: Buffer overflow vulnerabilities are one of the most common and dangerous software vulnerabilities; however, the complexity of software code makes predicting buffer overflow vulnerabilities in software challenging.Objective: To accurately predict multiple types of software buffer overflow vulnerabilities, this paper proposes a multitype software buffer overflow vulnerability prediction method called MSVAGraph that is based on the graph structure of software and a self-attentive graph neural network.Method: First, by analyzing software buffer overflow type vulnerabilities, a vulnerability feature set GSVFset extraction method based on graph structure is proposed to act as the software's basic unit. Second, a self-attentive pooling mechanism is used to design a vulnerability feature update mechanism based on a self-attentive graph neural network to transform the graph structure of the vulnerability feature set GSVFset into a feature vector representation. Finally, based on the updated GSVFset feature vector, a time-recursive-based neural network is designed to construct a prediction method for multitype software buffer overflow vulnerabilities.Results: The method proposed in this paper validates executable programs of four types of buffer overflow vul-nerabilities in the Juliet dataset using precision, accuracy, recall and F1 value as evaluation metrics. The pre-diction results have higher values after introducing the self-attentive pooling mechanism.Conclusion: The proposed MSVAGraph achieves high precision, accuracy, recall and F1 value, and can better preserve the network topology and node content information of graphs in the software's graph structure.
Keywords:
Software graph structure
Self-attentive
Graph neural networks
Multitype buffer overflow vulnerability
Journal
IF:
4.3
Papers:
3.7K
Citations:
7.7K