一句话：首个融合静态代码信息与动态符号执行轨迹的深度学习漏洞预测系统，发现 37 个新 CVE。
现有基于深度学习的漏洞检测方法在程序表示上存在不足：要么难以刻画精确程序语义，要么可扩展性差。本文提出 Concoction，首个结合静态源代码信息与动态执行轨迹学习程序表示的深度学习系统。它用无监督主动学习挑选重要路径来收集动态符号执行轨迹，并以聚焦式符号执行降低开销。作者将 Concoction 与模糊测试集成，检测 20 个开源 C 项目的函数级漏洞。在 200 小时并发测试中，系统在所有项目中发现漏洞，识别 54 个唯一漏洞并获 37 个新 CVE 编号；相比 16 种已有方法，准确率更高、误报率更低。
Deep learning (DL) has emerged as a viable means for identifying software bugs and vulnerabilities. The success of DL relies on having a suitable representation of the problem domain. However, existing DL-based solutions for learning program representations have limitations - they either cannot capture the deep, precise program semantics or suffer from poor scalability. We present Concoction, the first DL system to learn program presentations by combining static source code information and dynamic program execution traces. Concoction employs unsupervised active learning techniques to determine a subset of important paths to collect dynamic symbolic execution traces. By implementing a focused symbolic execution solution, Concoction brings the benefits of static and dynamic code features while reducing the expensive symbolic execution overhead. We integrate Concoction with fuzzing techniques to detect function-level code vulnerabilities in C programs from 20 open-source projects. In 200 hours of automated concurrent test runs, Concoction has successfully uncovered vulnerabilities in all tested projects, identifying 54 unique vulnerabilities and yielding 37 new, unique CVE IDs. Concoction also significantly outperforms 16 prior methods by providing higher accuracy and lower false positive rates.
@inproceedings{paperbot11302,
title = {Combining Structured Static Code Information and Dynamic Symbolic Traces for Software Vulnerability Prediction},
author = {Huanting Wang and Zhanyong Tang and Shin Hwei Tan and Jie Wang and Yuzhe Liu and Hejun Fang and Chunwei Xia and Zheng Wang},
booktitle = {ICSE},
year = {2024},
doi = {10.1145/3597503.3639212}
}