一句话：针对文本方法缺少语义、图方法难以扩展的矛盾，提出 VulCNN 以兼顾漏洞检测的准确性与可扩展性。
本文关注源代码漏洞检测。基于深度学习的文本方法可直接处理源代码，具备较好的可扩展性，但因缺少程序语义而检测精度不足；基于图表示的方法将程序语义蒸馏为图并用于检测，精度较高，但图分析通常耗时，难以扩展到大规模代码。VulCNN 的标题表明其采用卷积神经网络（CNN）思路，目标是在这两类方法之间取得平衡，实现可扩展的漏洞扫描，同时尽可能保留程序语义信息。摘要未提供具体模型结构、数据集或实验结果，因此无法进一步概括其关键发现。
Since deep learning (DL) can automatically learn features from source code, it has been widely used to detect source code vulnerability. To achieve scalable vulnerability scanning, some prior studies intend to process the source code directly by treating them as text. To achieve accurate vulnerability detection, other approaches consider distilling the program semantics into graph representations and using them to detect vulnerability. In practice, text-based techniques are scalable but not accurate due to the lack of program semantics. Graph-based methods are accurate but not scalable since graph analysis is typically time-consuming.
DOI 原文 ·
@inproceedings{paperbot6943,
title = {VulCNN},
author = {Yueming Wu and Deqing Zou and Shihan Dou and Wei Yang and Duo Xu and Hai Jin},
booktitle = {ICSE},
year = {2022},
doi = {10.1145/3510003.3510229}
}