VulDeePecker: A Deep Learning-Based System for Vulnerability Detection (2018-01-05T00:00:00.000000Z)

TL;DR

The study of using deep learning-based vulnerability detection to relieve human experts from the tedious and subjective task of manually defining features and Experimental results show that VulDeePecker can achieve much fewer false negatives and reasonable false positives than other approaches.

Abstract

The automatic detection of software vulnerabilities is an important research problem. However, existing solutions to this problem rely on human experts to define features and often miss many vulnerabilities (i.e., incurring high false negative rate). In this paper, we initiate the study of using deep learning-based vulnerability detection to relieve human experts from the tedious and subjective task of manually defining features. Since deep learning is motivated to deal with problems that are very different from the problem of vulnerability detection, we need some guiding principles for applying deep learning to vulnerability detection. In particular, we need to find representations of software programs that are suitable for deep learning. For this purpose, we propose using code gadgets to represent programs and then transform them into vectors, where a code gadget is a number of (not necessarily consecutive) lines of code that are semantically related to each other. This leads to the design and implementation of a deep learning-based vulnerability detection system, called Vulnerability Deep Pecker (VulDeePecker). In order to evaluate VulDeePecker, we present the first vulnerability dataset for deep learning approaches. Experimental results show that VulDeePecker can achieve much fewer false negatives (with reasonable false positives) than other approaches. We further apply VulDeePecker to 3 software products (namely Xen, Seamonkey, and Libav) and detect 4 vulnerabilities, which are not reported in the National Vulnerability Database but were "silently" patched by the vendors when releasing later versions of these products; in contrast, these vulnerabilities are almost entirely missed by the other vulnerability detection systems we experimented with.

References57 items

VUDDY: A Scalable Approach for Vulnerable Code Clone Discovery

eXpose: A Character-Level Convolutional Neural Network with Embeddings For Detecting Malicious URLs, File Paths and Registry Keys

A Survey on Systems Security Metrics

Word2Vec

VulPecker: an automated vulnerability detection system based on code similarity analysis

Lattice-Based Recurrent Neural Network Encoders for Neural Machine Translation

Deep learning code fragments for code clone detection

Deep API learning

Automatically Learning Semantic Features for Defect Prediction

Evaluating and comparing complexity, coupling and a new proposed set of coupling metrics in cross-project vulnerability prediction

Toward Large-Scale Vulnerability Discovery using Machine Learning

SourcererCC: Scaling Code Clone Detection to Big-Code

Recognizing Functions in Binaries with Neural Networks

Deep Learning for Just-in-Time Defect Prediction

An Empirical Exploration of Recurrent Network Architectures

Automatic Inference of Search Patterns for Taint-Style Vulnerabilities

Toward Deep Learning Software Repositories

Code-reuse attacks and defenses

Challenges with applying vulnerability prediction models

Adam: A Method for Stochastic Optimization

Show and tell: A neural image caption generator

Predicting Vulnerable Software Components via Text Mining

GloVe: Global Vectors for Word Representation

Building Program Vector Representations for Deep Learning

On the Properties of Neural Machine Translation: Encoder–Decoder Approaches

Chucky: exposing missing checks in source code for vulnerability discovery

Software clone detection: A systematic review

Generalized vulnerability extrapolation using abstract syntax trees

ImageNet classification with deep convolutional neural networks

CBCD: Cloned buggy code detector

ReDeBug: Finding Unpatched Code Clones in Entire OS Distributions

Evaluating Complexity, Code Churn, and Developer Activity Metrics as Indicators of Software Vulnerabilities

Vulnerability Extrapolation: Assisted Discovery of Vulnerabilities Using Machine Learning

Detection of recurring software vulnerabilities

The Beauty and the Beast: Vulnerabilities in Red Hat's Packages

Automatic Discovery and Quantification of Information Leaks

Program slicing

Predicting vulnerable software components

DECKARD: Scalable and Accurate Tree-Based Detection of Code Clones

ITS4: a static vulnerability scanner for C and C++ code

System-dependence-graph-based slicing of programs with arbitrary interprocedural control flow

Long Short-Term Memory

Bidirectional recurrent neural networks

Distributed Representations

Joint word2vec Networks for Bilingual Semantic Representations

“Deep neural networks for acoustic modeling in speech recognition: The shared views of four research groups,”

“Theano: A CPU and GPU math expression compiler,”

Learning Deep Architectures for AI

Augmenting WordNet-like lexical resources with distributional evidence. An application-oriented perspective

Interprocedural slicing using dependence graphs

Table V. R ESULTS FOR ANSWERING RQ3: V UL D EE P ECKER ACHIEVES A MUCH SMALLER OVERALL FNR OF 7.0% CORRESPONDING TO THE

generated by the commercial product Checkmarx [2]

f lt = σ ( W lxf x lt + W lhf h lt − 1 + W lcf c lt − 1 + b lf )

Windows API functions

the network ( l = 1 ), W lxi , W lxf , W lxo , W lxc are the weight matrices connecting x lt with the input gate, the forget gate, the output gate, and the LSTM cell input

layer l

Rough Audit Tool for Security