脆弱性模仿突变体
Vulnerability Mimicking Mutants
摘要：
随着在大型代码语料库上训练的强大语言模型的不断发布（例如CodeBERT在640万个程序上训练），一个新的突变测试工具家族已经出现，并有望生成更多“自然”的突变体，因为突变代码旨在遵循程序员通常产生的隐式规则和编码约定。在本文中，我们研究在何种程度上的突变产生的语言模型可以语义模仿可观察的行为的安全相关的漏洞（a.k.a.）。漏洞模仿突变体），这样设计的测试用例，这些突变体失败将有助于解决模仿的漏洞。由于分析和运行突变体在计算上是昂贵的，因此在任何分析或测试执行之前优先考虑那些更可能是漏洞模仿的突变体是很重要的。考虑到这一点，我们引入VMMS，一个基于机器学习的方法，自动提取突变体的功能，并预测那些模仿漏洞。我们在45个漏洞的数据集上进行了实验，发现16.6%的突变体在一个或多个测试中失败，而88.9%的相应漏洞失败。更准确地说，整个突变体集中有3.9%的突变体是模仿脆弱性的突变体，它们模仿了55.6%的脆弱性。尽管稀缺，VMMS预测具有0.63 MCC，0.80精度和0.51召回的可重复性模仿突变体，表明可重复性模仿突变体的特征可以通过机器学习模型自动学习以静态地预测这些，而不需要在定义这些特征方面投入精力。
英文摘要：
With the increasing release of powerful language models trained on large code corpus (e.g. CodeBERT was trained on 6.4 million programs), a new family of mutation testing tools has arisen with the promise to generate more "natural" mutants in the sense that the mutated code aims at following the implicit rules and coding conventions typically produced by programmers. In this paper, we study to what extent the mutants produced by language models can semantically mimic the observable behavior of security-related vulnerabilities (a.k.a. Vulnerability-mimicking Mutants), so that designing test cases that are failed by these mutants will help in tackling mimicked vulnerabilities. Since analyzing and running mutants is computationally expensive, it is important to prioritize those mutants that are more likely to be vulnerability mimicking prior to any analysis or test execution. Taking this into account, we introduce VMMS, a machine learning based approach that automatically extracts the features from mutants and predicts the ones that mimic vulnerabilities. We conducted our experiments on a dataset of 45 vulnerabilities and found that 16.6% of the mutants fail one or more tests that are failed by 88.9% of the respective vulnerabilities. More precisely, 3.9% of the mutants from the entire mutant set are vulnerability-mimicking mutants that mimic 55.6% of the vulnerabilities. Despite the scarcity, VMMS predicts vulnerability-mimicking mutants with 0.63 MCC, 0.80 Precision, and 0.51 Recall, demonstrating that the features of vulnerability-mimicking mutants can be automatically learned by machine learning models to statically predict these without the need of investing effort in defining such features.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
