VulSPG：基于切片属性图表示学习的漏洞检测
VulSPG: Vulnerability detection based on slice property graph representation learning
摘要：
漏洞检测是软件安全中的一个重要问题。尽管已经提出了各种数据驱动的漏洞检测方法，但由于现实世界中易受攻击代码在语法和语义上的多样性和复杂性使得难以使用常规深度学习模型提取易受攻击的特征，特别是在分析大型程序时。此外，现实世界中的脆弱代码包含大量与脆弱性无关的冗余信息，这一事实将进一步加剧上述问题。为了缓解这些挑战，我们定义了一种新的代码表示命名为切片属性图（SPG），然后提出VulSPG，一种新的漏洞检测方法，使用改进的R-GCN模型与三重注意力机制，以确定潜在的漏洞SPG。与其他方法相比，我们的方法至少有两个优点。首先，我们提出的SPG可以反映丰富的语义和明确的结构信息，可能是相关的漏洞，同时消除尽可能多的无关信息，以减少图的复杂性。其次，VulSPG在R-GCN中引入了三重注意力机制，以实现从SPG中更有效地学习漏洞模式。我们已经在两个大规模数据集上广泛评估了VulSPG，其中包括来自SARD和真实项目的程序。实验结果证明了VulSPG的有效性和效率。
英文摘要：
Vulnerability detection is an important issue in software security. Although various data-driven vulnerability detection methods have been proposed, the task remains challenging since the diversity and complexity of real-world vulnerable code in syntax and semantics make it difficult to extract vulnerable features with regular deep learning models, especially in analyzing a large program. Moreover, the fact that real-world vulnerable codes contain a lot of redundant information unrelated to vulnerabilities will further aggravate the above problem. To mitigate such challenges, we define a novel code representation named Slice Property Graph (SPG), and then propose VulSPG, a new vulnerability detection approach using the improved R-GCN model with triple attention mechanism to identify potential vulnerabilities in SPG. Our approach has at least two advantages over other methods. First, our proposed SPG can reflect the rich semantics and explicit structural information that may be relevance to vulnerabilities, while eliminating as much irrelevant information as possible to reduce the complexity of graph. Second, VulSPG incorporates triple attention mechanism in R-GCNs to achieve more effective learning of vulnerability patterns from SPG. We have extensively evaluated VulSPG on two large-scale datasets with programs from SARD and real-world projects. Experimental results prove the effectiveness and efficiency of VulSPG.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
