Software Vulnerability Prediction Knowledge Transferring Between Programming Languages

被引：0

作者：

Hanifi, Khadija ^{[1
]}

Fouladi, Ramin F. ^{[1
]}

Unsalver, Basak Gencer ^{[2
]}

Karadag, Goksu ^{[2
]}

机构：

[1] Ericsson Secur Res, Istanbul, Turkiye

[2] Vodafone, Istanbul, Turkiye

来源：

PROCEEDINGS OF THE 18TH INTERNATIONAL CONFERENCE ON EVALUATION OF NOVEL APPROACHES TO SOFTWARE ENGINEERING, ENASE 2023 | 2023年

关键词：

Software Security; Vulnerability Prediction; Source Code; Machine Learning; Transfer Learning;

D O I：

10.5220/0011859800003464

中图分类号：

TP31 [计算机软件];

学科分类号：

081202 ; 0835 ;

摘要：

Developing automated and smart software vulnerability detection models has been receiving great attention from both research and development communities. One of the biggest challenges in this area is the lack of code samples for all different programming languages. In this study, we address this issue by proposing a transfer learning technique to leverage available datasets and generate a model to detect common vulnerabilities in different programming languages. We use C source code samples to train a Convolutional Neural Network (CNN) model, then, we use Java source code samples to adopt and evaluate the learned model. We use code samples from two benchmark datasets: NIST Software Assurance Reference Dataset (SARD) and Draper VDISC dataset. The results show that proposed model detects vulnerabilities in both C and Java codes with average recall of 72%. Additionally, we employ explainable AI to investigate how much each feature contributes to the knowledge transfer mechanisms between C and Java in the proposed model.

引用

页码：479 / 486

页数：8

共 15 条

[1] Vulnerability Prediction From Source Code Using Machine Learning [J].

Bilgin, Zeki ;

Ersoy, Mehmet Akif ;

Soykan, Elif Ustundag ;

Tomur, Emrah ;

Comak, Pinar ;

Karacay, Leyli .

IEEE ACCESS, 2020, 8 :150672-150684

[2]

Black PE, 2018, J RES NATL INST STAN, V123, DOI [10.6028/jres.123.005, 10.6028/123.005]

[3] Profiling Developers to Predict Vulnerable Code Changes [J].

Coskun, Tugce ;

Halepmollasi, Rusen ;

Hanifi, Khadija ;

Fouladi, Ramin Fadaei ;

De Cnudde, Pinar Comak ;

Tosun, Ayse .

PROCEEDINGS OF THE 18TH INTERNATIONAL CONFERENCE ON PREDICTIVE MODELS AND DATA ANALYTICS IN SOFTWARE ENGINEERING, PROMISE 2022, 2022, :32-41

[4]

Devlin J, 2019, Arxiv, DOI arXiv:1810.04805

[5]

Duan X, 2019, PROCEEDINGS OF THE TWENTY-EIGHTH INTERNATIONAL JOINT CONFERENCE ON ARTIFICIAL INTELLIGENCE, P4665

[6]

Halepmollasi R., 2023, ENASE

[7] The rise of software vulnerability: Taxonomy of software vulnerabilities detection and machine learning approaches [J].

Hanif, Hazim ;

Nasir, Mohd Hairul Nizam Md ;

Ab Razak, Mohd Faizal ;

Firdaus, Ahmad ;

Anuar, Nor Badrul .

JOURNAL OF NETWORK AND COMPUTER APPLICATIONS, 2021, 179

[8] Examining the Capacity of Text Mining and Software Metrics in Vulnerability Prediction [J].

Kalouptsoglou, Ilias ;

Siavvas, Miltiadis ;

Kehagias, Dionysios ;

Chatzigeorgiou, Alexandros ;

Ampatzoglou, Apostolos .

ENTROPY, 2022, 24 (05)

[9] Automated Software Vulnerability Detection Based on Hybrid Neural Network [J].

Li, Xin ;

Wang, Lu ;

Xin, Yang ;

Yang, Yixian ;

Tang, Qifeng ;

Chen, Yuling .

APPLIED SCIENCES-BASEL, 2021, 11 (07)

[10] Software Vulnerability Detection Using Deep Neural Networks: A Survey [J].

Lin, Guanjun ;

Wen, Sheng ;

Han, Qing-Long ;

Zhang, Jun ;

Xiang, Yang .

PROCEEDINGS OF THE IEEE, 2020, 108 (10) :1825-1848

← 1 2 →