基于图深度学习的漏洞检测  

Survey of vulnerability detectionbasedon graph deep learning

作　　者：董继平 郭启全 高春东 郝蒙蒙[1,2,3] 江东 DON Jiping;CUO Qiquan;AO Chundong;AO Mengmeng;JIANG Dong(Institute of Geographic Sciences and Nature Resources Research,Chinese Academy of Sciences,Beijing 100101,China;Laboratory of Cyberspace Geography,Chinese Academy of Sciences and The Ministry of Public Security of the People's Republic of China,Beijing 100101,China;College of Resources and Environment,University of Chinese Academy of Sciences,Beijing 100190,China)

机构地区：[1]中国科学院地理科学与资源研究所,北京100101 [2]中国科学院公安部网络空间地理学实验室,北京100101 [3]中国科学院大学资源与环境学院,北京100190

出　　处：《科技导报》2023年第13期41-59,共19页Science & Technology Review

基　　金：中国科学院重点部署项目(ZDRW-XH-2021-3)。

摘　　要：图深度学习技术在处理非欧氏结构数据中显示了巨大潜力,大量研究工作尝试将图嵌入或图神经网络应用到漏洞检测中。梳理了基于图深度学习的漏洞检测方法,按其一般流程,归纳了数据集、图数据、图深度学习模型构建及结果评估4个主要阶段;从图深度学习漏洞检测的有效性出发,阐述了基于代码模式和基于相似性及具体应用场景中的研究成果;分析了该领域面临的挑战和未来的趋势。The recent advances made by graph-based deep learning have demonstrated its great potential in processing non-Euclidean structured data,and a large number of research efforts have attempted to apply graph embeddings or graph neural networks to vulnerability detection.This survey systematically investigates the vulnerability detection based on graph deep learning.Firstly,we summarize the four main stages of the vulnerability detection process,including data set,graph data preparation,graph deep learning model construction,and result evaluation.Then,starting from the effectiveness of graph-based deep learning vulnerability detection,we respectively expound the research results based on code patterns,code similarity and specific application scenarios.Finally,by sorting out and summarizing the existing research works,we analyze the challenges and foresee the trends in this research field.

关 键 词：网络安全 漏洞检测 图深度学习 图嵌入 图神经网络 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术] TP18[自动化与计算机技术—计算机科学与技术]