一句话：提出结合精确静态分析与神经网络安全代码生成的多位置密码代码修复方法。
Java 密码 API 易被误用并导致漏洞，修复需安全专业知识，且要保证多个代码位置间的密码学一致性。该博士研究提出多位置密码代码修复系统，以精确静态分析为基础，结合神经网络进行安全代码生成，并由程序分析引导模型学习安全代码以给出准确建议。作者先系统比较不同分析策略下的密码 API 嵌入，识别出区分功能相似 API 和捕获低频代码模式两个编程语言特定挑战，并用多路径建议架构与低频增强序列学习解决。现有结果显示，其 top-1 准确率显著优于最新方法；下一步是密码学一致定位，并已发布大型 Java 密码代码数据集。
Java Cryptographic API libraries are error-prone and result in vulnerabilities. The fixes of them often require security expertise and extra consideration for cryptographic consistency at multiple code locations. My Ph.D. research aims to help developers with a multi-location cryptographic code repair system. The proposed method relies on a precise static analysis for cryptographic code and a neural network based secure code generation solution. We focus on designing neural network based techniques guided by program analysis to learn from the secure code and give accurate suggestions. First, we conducted a comprehensive measurement to compare cryptographic API embeddings guided by different program analysis strategies. Then, we identified two previously unreported programming language-specific challenges, differentiating functionally similar APIs and capturing low-frequency code patterns. We address them by a specialized multi-path code suggestion architecture, and a novel low-frequency enhanced sequence learning technique. Existing results show that our approach achieves significant improvements on top-1 accuracy compared with the state-of-the-art.Our next step is an cryptographic consistent localization that enables our multi-location code repair. We publish our data and code as a large Java cryptographic code dataset.
DOI 原文 ·
@inproceedings{paperbot6367,
title = {Multi-location cryptographic code repair with neural-network-based methodologies},
author = {Ya Xiao},
booktitle = {FSE},
year = {2021},
doi = {10.1145/3468264.3473102}
}