基于多表征融合的函数级代码漏洞检测方法  

Function-level code vulnerability detection method based on multi-representation fusion

作　　者：田振洲 吕佳俊 王凡凡 TIAN Zhenzhou;LYU Jiajun;WANG Fanfan(School of Computer Science and Technology,Xi an University of Posts and Telecommunications,Xi an 710121,China)

机构地区：[1]西安邮电大学计算机学院,陕西西安710121

出　　处：《西安邮电大学学报》2023年第1期78-84,共7页Journal of Xi’an University of Posts and Telecommunications

基　　金：国家自然科学基金项目(61702414);陕西省自然科学基础研究计划项目(2022JM-342,2018JQ6078)。

摘　　要：针对采用单一表征结构时,网络模型无法全面学习代码所承载的语义信息的问题,提出一种多表征融合的函数级代码漏洞检测(Sequence and Structure Fusion based Vulnerability Detector,S 2FVD)方法。该方法使用针对序列的神经网络TextCNN和针对图结构的图卷积神经网络,分别从函数的Token序列和属性控制流图中,提取深层语义特征并进行有机融合,从而实现函数级漏洞的精准检测。在公共数据集上开展的实验结果表明,S 2FVD能够在函数级上有效检测漏洞的存在,且相比现有方法表现出更好的检测性能。For the problem that the network model cannot fully learn the semantic information carried by the code when using a single representation structure,a novel function level code vulnerability detection method called S 2FVD(Sequence and Structure Fusion based Vulnerability Detector)is propose.The neural network TextCNN for sequence and the graph convolutional neural network for graph structure are used to extract the deep semantic features from the Token sequence and attributed control flow graph of each function,which were further fused to achieve accurate function level vulnerability detection.Experiments conducted on a public data set show that,S 2FVD can effectively detect the existence of vulnerabilities at the functional level,and performs better than the existing methods.

关 键 词：漏洞检测 深度学习 表征融合 图神经网络 属性控制流图 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]