arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2402.00657cs.SE
收藏

面向漏洞分析任务的基于程序依赖预测的预训练方法

Pre-training by Predicting Program Dependencies for Vulnerability Analysis Tasks

Zhongxin Liu, Zhijie Tang, Junwei Zhang, Xin Xia, Xiaohu Yang

备注：
Accepted by ICSE 2024
阅读 PDF
arXiv 页面 ↗HTML 原文 ↗

AI总结：

针对现有代码预训练目标忽略或未充分利用代码语义结构知识的问题，提出控制依赖预测和数据依赖预测两种预训练目标，构建的PDBERT模型在三项漏洞分析任务上达SOTA，且依赖预测性能优异。

摘要：

漏洞分析对软件安全至关重要。本研究聚焦于利用预训练技术增强对漏洞代码的理解，提升漏洞分析效果。预训练模型的代码理解能力与其预训练目标高度相关，而代码的语义结构（如控制依赖和数据依赖）对漏洞分析十分重要。但现有预训练目标要么忽略这类结构，要么仅聚焦于学习如何使用它，尚未有研究探讨学习语义结构分析知识的可行性与收益。为此，本研究提出两种新颖的预训练目标，即控制依赖预测（Control Dependency Prediction, CDP）和数据依赖预测（Data Dependency Prediction, DDP），二者分别仅基于代码片段的源代码，预测其中语句级的控制依赖和词元级的数据依赖。预训练过程中，CDP和DDP可引导模型学习分析代码细粒度依赖所需的知识；预训练完成后，所得预训练模型既能在微调阶段增强对漏洞代码的理解，也可直接用于对部分函数和完整函数执行依赖分析。为验证预训练目标的效果，我们用CDP和DDP预训练了一个名为PDBERT的Transformer模型，在漏洞检测、漏洞分类、漏洞评估三项漏洞分析任务上对其进行微调，并在程序依赖分析任务上开展评估。实验结果表明，PDBERT得益于CDP和DDP，在三项下游任务上取得了当前最优性能；同时，在预测部分函数与完整函数的控制依赖和数据依赖任务上，PDBERT的F1值分别超过99%和94%。

英文摘要：

Vulnerability analysis is crucial for software security. This work focuses on using pre-training techniques to enhance the understanding of vulnerable code and boost vulnerability analysis. The code understanding ability of a pre-trained model is highly related to its pre-training objectives. The semantic structure, e.g., control and data dependencies, of code is important for vulnerability analysis. However, existing pre-training objectives either ignore such structure or focus on learning to use it. The feasibility and benefits of learning the knowledge of analyzing semantic structure have not been investigated. To this end, this work proposes two novel pre-training objectives, namely Control Dependency Prediction (CDP) and Data Dependency Prediction (DDP), which aim to predict the statement-level control dependencies and token-level data dependencies, respectively, in a code snippet only based on its source code. During pre-training, CDP and DDP can guide the model to learn the knowledge required for analyzing fine-grained dependencies in code. After pre-training, the pre-trained model can boost the understanding of vulnerable code during fine-tuning and can directly be used to perform dependence analysis for both partial and complete functions. To demonstrate the benefits of our pre-training objectives, we pre-train a Transformer model named PDBERT with CDP and DDP, fine-tune it on three vulnerability analysis tasks, i.e., vulnerability detection, vulnerability classification, and vulnerability assessment, and also evaluate it on program dependence analysis. Experimental results show that PDBERT benefits from CDP and DDP, leading to state-of-the-art performance on the three downstream tasks. Also, PDBERT achieves F1-scores of over 99% and 94% for predicting control and data dependencies, respectively, in partial and complete functions.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

↑