基于深度聚类的开源软件漏洞检测方法  

Open source software vulnerability detection method based on deep clustering

作　　者：李元诚[1] 黄戎 来风刚 毛一凡 蔡力军 Li Yuancheng;Huang Rong;Lai Fenggang;Mao Yifan;Cai Lijun(School of Control&Computer Engineering,North China Electric Power University,Beijing 102206,China;State Grid Information&Tele-communication Branch,Beijing 100761,China;State Grid Fujian Information&Telecommunication Branch,Fuzhou 350003,China)

机构地区：[1]华北电力大学控制与计算机工程学院,北京102206 [2]国家电网公司信息通信分公司,北京100761 [3]国网福建省电力有限公司信息通信分公司,福州350003

出　　处：《计算机应用研究》2020年第4期1107-1110,1114,共5页Application Research of Computers

基　　金：国家电网公司总部科技项目(SGFJXT00YJJS1800074)。

摘　　要：针对开源软件漏洞,提出一种基于深度聚类算法的软件源代码漏洞检测方法。该方法利用代码图模型构造开源软件代码属性图,遍历得到关键代码节点并提取出应用程序编程接口(API)序列,将其嵌入向量空间,以关键代码为中心进行聚类,根据聚类结果计算每个函数的异常值,生成检测报告并匹配漏洞库,从而检测出源代码中的漏洞。实验结果表明,该方法能够定位开源软件中漏洞所在的关键代码段并检测出相应漏洞。Aiming at the open source software vulnerability,this paper proposed a software source code vulnerability detection method based on deep clustering algorithm.This method used code graph model to construct the code attribute map and tra-versed the key code nodes to extract the application programming interfaces(API)sequence,then took the key sequence as the center to cluster and calculated the outliers of the function in each clustering to generate a test report,matched the vulnerability library to detect vulnerabilities in the source code.The experimental results show that the proposed method can locate the key code segments of the vulnerability in open source software and detect the vulnerability.

关 键 词：开源软件 漏洞检测 源代码分析 深度学习 聚类 

分 类 号：TP311.5[自动化与计算机技术—计算机软件与理论]