Files and links (2)
Published (Version of record)CC BY V4.0, Open Access
Published (Version of record)CC BY V4.0, Open
Journal article
A Context-Aware Neural Embedding for Function-Level Vulnerability Detection
Algorithms, Vol.14(11), 335
17/11/2021
Metrics
1 Record Views
Abstract
Exploitable vulnerabilities in software systems are major security concerns. To date, machine learning (ML) based solutions have been proposed to automate and accelerate the detection of vulnerabilities. Most ML techniques aim to isolate a unit of source code, be it a line or a function, as being vulnerable. We argue that a code segment is vulnerable if it exists in certain semantic contexts, such as the control flow and data flow; therefore, it is important for the detection to be context aware. In this paper, we evaluate the performance of mainstream word embedding techniques in the scenario of software vulnerability detection. Based on the evaluation, we propose a supervised framework leveraging pre-trained context-aware embeddings from language models (ELMo) to capture deep contextual representations, further summarized by a bidirectional long short-term memory (Bi-LSTM) layer for learning long-range code dependency. The framework takes directly a source code function as an input and produces corresponding function embeddings, which can be treated as feature sets for conventional ML classifiers. Experimental results showed that the proposed framework yielded the best performance in its downstream detection tasks. Using the feature representations generated by our framework, random forest and support vector machine outperformed four baseline systems on our data sets, demonstrating that the framework incorporated with ELMo can effectively capture the vulnerable data flow patterns and facilitate the vulnerability detection task.
Details
- Title
- A Context-Aware Neural Embedding for Function-Level Vulnerability Detection
- Creators
- Hongwei Wei - Sanming UniversityGuanjun Lin - Sanming UniversityLin Li - Swinburne University of TechnologyHeming Jia - Sanming University
- Publication Details
- Algorithms, Vol.14(11), 335
- Publisher
- MDPI
- Number of pages
- 20
- Grant note
- This work was supported in part by the Natural Science Foundation Project of Fujian Province, China, under Grant 2021J011131 and 2021J011128, and in part by the National innovation and Entrepreneurship Program for College Students, under Grant 202111311014.
- Identifiers
- 991013225624802368
- Copyright
- © 2021 by the authors.
- Academic Unit
- Faculty of Science and Engineering
- Language
- English
- Resource Type
- Journal article