源代码缺陷检测数据生成及标注方法

Data generation and annotation method for source code defect detection

在已有的基于深度学习的源代码缺陷检测方法中,所使用的训练数据和测试数据大多来源于仅供学术研究的测试源码,无法为深度学习模型的训练提供足够的数据支撑。因此,该文提出了一种源代码缺陷检测数据生成及标注方法。该方法在提取源代码控制流关系的基础上,应用已训练的深度学习模型和商业工具来完成源代码切片数据的标注。使用公开数据集SARD、NVD及开源软件Ffmpeg等进行验证,结果表明通过该方法能够生成直接用于深度学习的源代码缺陷检测数据集,为基于深度学习的源代码缺陷检测方法提供了数据支撑。

Existing deep learning based source code vulnerability detection methods use training and test data sets that are mostly derived from test source codes for academic research only which do not provide sufficient support for training of deep learning models.This paper presents a data generation and annotation method for source code defect detection.This method extracts the source code control flow relationships and uses trained deep learning models and commercial tools to complete the slice data annotation of the source code.The public data sets SARD,NVD and the open-source code Ffmpeg are utilized to verify the system performance.The results show that this method can generate a source code defect dataset for deep learning to support deep learning-based source code vulnerability detection methods.