arXivDaily arXiv每日学术速递 周一至周五更新
北美退伍军人节(Veterans Day),12 日无更新
arXiv 2303.07525cs.LGcs.CV
收藏

使用量子自然语言处理的Source Code中的自动漏洞检测

Automated Vulnerability Detection in Source Code Using Quantum Natural Language Processing

Kennesaw State University(肯尼索州立大学);Fordham University(福特汉姆大学)

Mst Shapna Akter, Hossain Shahriar, Zakirul Alam Bhuiya

摘要:

软件代码审计领域最重要的挑战之一是软件源代码中存在的漏洞。这些漏洞极有可能被利用,并导致系统受损、数据泄漏或拒绝服务。C和C++开放源代码现已可用,以创建用于功能级漏洞识别的大规模经典机器学习和量子机器学习系统。我们收集了数百万个开源函数的数据集,这些函数指向潜在的漏洞。我们基于深度神经网络模型长短期记忆(LSTM)和量子机器学习模型长短期记忆(QLSTM)创建了一种高效且可扩展的漏洞检测方法,可以学习从源代码中提取的特征。首先将源代码转换为最小的中间表示,以去除无意义的组件并缩短依赖性。因此,我们使用最先进的词嵌入算法,如Glove和fastText,保持语义和句法信息。嵌入的向量随后被馈送到经典和量子卷积神经网络中,以对可能的漏洞进行分类。为了衡量性能,我们使用了一些评估指标,如F1分数、精确度、重新调用、准确度和总执行时间。我们使用基本特征表示以及语义和语法表示对经典LSTM和量子LSTM的结果进行了比较。我们发现,具有语义和语法特征的QLSTM检测到显着准确的漏洞,运行速度比其经典的同行。

英文摘要:

One of the most important challenges in the field of software code audit is the presence of vulnerabilities in software source code. These flaws are highly likely ex-ploited and lead to system compromise, data leakage, or denial of ser-vice. C and C++ open source code are now available in order to create a large-scale, classical machine-learning and quantum machine-learning system for function-level vulnerability identification. We assembled a siz-able dataset of millions of open-source functions that point to poten-tial exploits. We created an efficient and scalable vulnerability detection method based on a deep neural network model Long Short Term Memory (LSTM), and quantum machine learning model Long Short Term Memory (QLSTM), that can learn features extracted from the source codes. The source code is first converted into a minimal intermediate representation to remove the pointless components and shorten the de-pendency. Therefore, We keep the semantic and syntactic information using state of the art word embedding algorithms such as Glove and fastText. The embedded vectors are subsequently fed into the classical and quantum convolutional neural networks to classify the possible vulnerabilities. To measure the performance, we used evaluation metrics such as F1 score, precision, re-call, accuracy, and total execution time. We made a comparison between the results derived from the classical LSTM and quantum LSTM using basic feature representation as well as semantic and syntactic represen-tation. We found that the QLSTM with semantic and syntactic features detects significantly accurate vulnerability and runs faster than its classical counterpart.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑