一句话：探索用机器学习更准确地定位源代码安全漏洞，并构建可配置检测工具与基准。
随着攻击及其损失增加，安全编码意识上升，但开发者常非安全专家，开发中会无意引入漏洞。静态分析工具误报率高，逐一处理告警耗费大量资源。该博士项目研究机器学习技术能否比普通静态分析方法更准确地定位源代码中的安全弱点。方法上关注当前的 machine learning on code 方法，开展初步研究，并计划构建按 CWE 分类的漏洞配置接口、比较现有源代码表示与机器学习架构的基准工具，以及可定制特征模型。最终目标是实现一个易用的、基于代码机器学习的漏洞检测工具。
The awareness of writing secure code rises with the increasing number of attacks and their resultant damage. But often, software developers are no security experts and vulnerabilities arise unconsciously during the development process. They use static analysis tools for bug detection, which often come with a high false positive rate. The developers, therefore, need a lot of resources to mind about all alarms, if they want to consistently take care of the security of their software project. We want to investigate, if machine learning techniques could point the user to the position of a security weak point in the source code with a higher accuracy than ordinary methods with static analysis. For this purpose, we focus on current machine learning on code approaches for our initial studies to evolve an efficient way for finding security-related software bugs. We will create a configuration interface to discover certain vulnerabilities, categorized in CWEs. We want to create a benchmark tool to compare existing source code representations and machine learning architectures for vulnerability detection and develop a customizable feature model. At the end of this PhD project, we want to have an easy-to-use vulnerability detection tool based on machine learning on code.
DOI 原文 ·
@inproceedings{paperbot5124,
title = {Machine-learning supported vulnerability detection in source code},
author = {Tim Sonnekalb},
booktitle = {FSE},
year = {2019},
doi = {10.1145/3338906.3341466}
}