源代码缺陷检测数据生成及标注方法  

Data generation and annotation method for source code defect detection

作　　者：管志斌 王晓萌 辛伟[1] 王嘉捷[1] GUAN Zhibin;WANG Xiaomeng;XIN Wei;WANG Jiajie(China Information Technology Security Evaluation Center,Beijing 100085,China)

机构地区：[1]中国信息安全测评中心,北京100085

出　　处：《清华大学学报（自然科学版）》2021年第11期1240-1245,共6页Journal of Tsinghua University(Science and Technology)

基　　金：国家自然科学基金资助项目(U1736110,U1836209,U1936211,U1836113,U1936101)。

摘　　要：在已有的基于深度学习的源代码缺陷检测方法中,所使用的训练数据和测试数据大多来源于仅供学术研究的测试源码,无法为深度学习模型的训练提供足够的数据支撑。因此,该文提出了一种源代码缺陷检测数据生成及标注方法。该方法在提取源代码控制流关系的基础上,应用已训练的深度学习模型和商业工具来完成源代码切片数据的标注。使用公开数据集SARD、NVD及开源软件Ffmpeg等进行验证,结果表明通过该方法能够生成直接用于深度学习的源代码缺陷检测数据集,为基于深度学习的源代码缺陷检测方法提供了数据支撑。Existing deep learning based source code vulnerability detection methods use training and test data sets that are mostly derived from test source codes for academic research only which do not provide sufficient support for training of deep learning models.This paper presents a data generation and annotation method for source code defect detection.This method extracts the source code control flow relationships and uses trained deep learning models and commercial tools to complete the slice data annotation of the source code.The public data sets SARD,NVD and the open-source code Ffmpeg are utilized to verify the system performance.The results show that this method can generate a source code defect dataset for deep learning to support deep learning-based source code vulnerability detection methods.

关 键 词：源代码缺陷检测 控制流 数据生成 样本标注 深度学习 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]