一句话：提出基于对比学习的路径敏感代码嵌入，使模型理解漏洞触发路径，以提升静态漏洞检测。
现有基于深度学习的静态漏洞检测方法通常将程序抽象为数据流图、抽象语法树等图结构，并在安全/易受攻击代码片段上训练图神经网络等分类模型。然而，这些模型以分类为目标，缺乏对漏洞语义（如漏洞触发路径）的理解，难以实现精确的缺陷检测。针对该问题，本文提出路径敏感的代码嵌入方法，借助对比学习学习能够刻画漏洞触发路径的代码表示。标题表明该方法面向软件漏洞检测，旨在将路径敏感信息融入嵌入，以支持更精确的静态漏洞检测。给出的摘要未提供具体评估设置与实验结果，因此无法总结其关键性能数据。
Machine learning and its promising branch deep learning have shown success in a wide range of application domains. Recently, much effort has been expended on applying deep learning techniques (e.g., graph neural networks) to static vulnerability detection as an alternative to conventional bug detection methods. To obtain the structural information of code, current learning approaches typically abstract a program in the form of graphs (e.g., data-flow graphs, abstract syntax trees), and then train an underlying classification model based on the (sub)graphs of safe and vulnerable code fragments for vulnerability prediction. However, these models are still insufficient for precise bug detection, because the objective of these models is to produce classification results rather than comprehending the semantics of vulnerabilities, e.g., pinpoint bug triggering paths, which are essential for static bug detection.
DOI 原文 ·
@inproceedings{paperbot7412,
title = {Path-sensitive code embedding via contrastive learning for software vulnerability detection},
author = {Xiao Cheng and Guanqin Zhang and Haoyu Wang and Yulei Sui},
booktitle = {ISSTA},
year = {2022},
doi = {10.1145/3533767.3534371}
}