Devign: Effective Vulnerability Identification by Learning Comprehensive Program Semantics via Graph Neural Networks

Abstract

Vulnerability identification is crucial to protect the software systems from attacks for cyber security. It is especially important to localize the vulnerable functions among the source code to facilitate the fix. However, it is a challenging and tedious process, and also requires specialized security expertise. Inspired by the work on manually-defined patterns of vulnerabilities from various code representation graphs and the recent advance on graph neural networks, we propose Devign, a general graph neural network based model for graph-level classification through learning on a rich set of code semantic representations. It includes a novel Conv module to efficiently extract useful features in the learned rich node representations for graph-level classification. The model is trained over manually labeled datasets built on 4 diversified large-scale open-source C projects that incorporate high complexity and variety of real source code instead of synthesis code used in previous works. The results of the extensive evaluation on the datasets demonstrate that Devign outperforms the state of the arts significantly with an average of 10.51% higher accuracy and 8.68\% F1 score, increases averagely 4.66% accuracy and 6.37% F1 by the Conv module.

accepted by NeurIPS 2019

Cited by in corpus (26)

• CodeXGLUE: A Machine Learning Benchmark Dataset for Code Understanding and Generation
• CVEfixes: Automated Collection of Vulnerabilities and Their Fixes from Open-Source Software
• Natural Language Generation and Understanding of Big Code for AI-Assisted Programming: A Review
• SynCoBERT: Syntax-Guided Multi-Modal Contrastive Pre-Training for Code Representation
• Retrieval-Augmented Generation for Code Summarization via Hybrid GNN
• Exploring Software Naturalness through Neural Language Models
• Unified Pre-training for Program Understanding and Generation
• Towards Causal Deep Learning for Vulnerability Detection
• CodeT5: Identifier-aware Unified Pre-trained Encoder-Decoder Models for Code Understanding and Generation
• BlockScope: Detecting and Investigating Propagated Vulnerabilities in Forked Blockchain Projects
• Software Vulnerability Detection via Deep Learning over Disaggregated Code Graph Representation
• SPI: Automated Identification of Security Patches via Commits
• On using distributed representations of source code for the detection of C security vulnerabilities
• D2A: A Dataset Built for AI-Based Vulnerability Detection Methods Using Differential Analysis
• Literature review on vulnerability detection using NLP technology
• InferCode: Self-Supervised Learning of Code Representations by Predicting Subtrees
• CoTexT: Multi-task Learning with Code-Text Transformer
• TreeCaps: Tree-Based Capsule Networks for Source Code Processing
• A ground-truth dataset of real security patches
• GraphSearchNet: Enhancing GNNs via Capturing Global Dependencies for Semantic Code Search
• Risks of ignoring uncertainty propagation in AI-augmented security pipelines
• Towards Making Deep Learning-based Vulnerability Detectors Robust
• How could Neural Networks understand Programs?
• Generating Adversarial Computer Programs using Optimized Obfuscations
• Empirical Network Structure of Malicious Programs
• Multi-context Attention Fusion Neural Network for Software Vulnerability Identification