基于关系图卷积网络的源代码漏洞检测

Source code vulnerability detection based on relational graph convolution network

软件安全的根源在于软件开发人员开发的源代码,但随着软件规模和复杂性不断提高,仅靠人工检测漏洞代价高昂且难以扩展,而现有的代码分析工具有较高的误报率与漏报率。为此,提出一种基于关系图卷积网络(RGCN)的自动化漏洞检测方法以进一步提高漏洞检测的精度。首先将程序源代码转换为包含语法、语义特征信息的CPG;然后使用RGCN对图结构进行表示学习;最后训练神经网络模型预测程序源代码中的漏洞。为验证所提方法的有效性,在真实的软件漏洞样本上开展了实验验证,结果表明所提方法的漏洞检测结果的召回率和F1值分别达到了80.27%和63.78%。与Flawfinder、VulDeepecker和基于图卷积网络(GCN)的同类方法相比,所提方法的F1值分别提高了182%、12%和55%,可见所提方法能有效提高漏洞检测能力。

The root cause of software security lies in the source code developed by software developers,but with the continues increasing size and complexity of software,it is costly and difficult to perform vulnerability detection only manually,while the existing code analysis tools have high false positive rate and false negative rate.Therefore,an automatic vulnerability detection method based on Relational Graph Convolution Network(RGCN)was proposed to further improve the accuracy of vulnerability detection.Firstly,the program source code was transformed into CPG containing syntax and semantic information.Then,representation learning was performed to the graph structure by RGCN.Finally,a neural network model was trained to predict the vulnerabilities in the program source code.To verify the effectiveness of the proposed method,an experimental validation was conducted on the real-world software vulnerability samples,and the results show that the recall and F1-measure of vulnerability detection results of the proposed method reach 80.27%and 63.78%respectively.Compared with Flawfinder,VulDeepecker and similar method based on Graph Convolution Network(GCN),the proposed method has the F1-measure increased by 182%,12%and 55%respectively.It can be seen that the proposed method can effectively improve the vulnerability detection capability.