Year: 2023
Type: article
Abstract: Security vulnerabilities in source code are a growing problem which can lead to financial, reputation, physical, and even human damage when exploited by malicious actors. The use of deep learning to locate these vulnerabilities before they are deployed is currently a major area of security research. Code graphs such as Abstract Syntax Trees and Code Property Graphs are commonly used as input data to deep learning models as they are highly expressive of the code’s function. However, as the length of source code increases, so too does the computational cost of vulnerability detection models. Typically this cost is managed by using only a sample of the input graph, however this is often done randomly and with little consideration for the lost information. Little work has been done to explore informed heuristic-based pruning methods that can be used to reduce graph size to manageable levels by removing information irrelevant to vulnerabilities, while preserving relevant information. We present “Semantic-enhanced Code Embedding for Vulnerability Detection” (SCEVD), a deep learning model for vulnerability detection that seeks to fill these gaps by using more detailed information about code semantics to select vulnerability-relevant features from code graphs. We propose several heuristic-based pruning methods, implement them as part of SCEVD, and conduct experiments to verify their effectiveness. Our heuristic-based pruning improves on vulnerability detection results by up to 12% over the baseline pruning method.
Source: IEEE Access
Institutions: Queensland University of Technology, Griffith University
Language: English
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: gold
Estimated APC paid: $1,950
OpenAlex ID: W4389232932