Software Vulnerability Detection via Deep Learning over Disaggregated Code Graph Representation
arXiv:2109.03341
Abstract
Identifying vulnerable code is a precautionary measure to counter software security breaches. Tedious expert effort has been spent to build static analyzers, yet insecure patterns are barely fully enumerated. This work explores a deep learning approach to automatically learn the insecure patterns from code corpora. Because code naturally admits graph structures with parsing, we develop a novel graph neural network (GNN) to exploit both the semantic context and structural regularity of a program, in order to improve prediction performance. Compared with a generic GNN, our enhancements include a synthesis of multiple representations learned from the several parsed graphs of a program, and a new training loss metric that leverages the fine granularity of labeling. Our model outperforms multiple text, image and graph-based approaches, across two real-world datasets.
arXiv commentSubmitted June 2020
References in corpus (10)
- Distributed Representations of Words and Phrases and their Compositionality
- Crystal Graph Convolutional Neural Networks for an Accurate and Interpretable Prediction of Material Properties
- Activation Functions: Comparison of trends in Practice and Research for Deep Learning
- Gated Graph Sequence Neural Networks
- CodeBERT: A Pre-Trained Model for Programming and Natural Languages
- Learning and Evaluating Contextual Embedding of Source Code
- Devign: Effective Vulnerability Identification by Learning Comprehensive Program Semantics via Graph Neural Networks
- Automated software vulnerability detection with machine learning
- Towards security defect prediction with AI
- End-to-End Prediction of Buffer Overruns from Raw Source Code via Neural Memory Networks