arXivDaily arXiv每日学术速递 周一至周五更新
arXiv周末暂无论文更新,休息一下吧,周末愉快~~
arXiv 2403.07501cs.LG
收藏

使用多标签机器学习检测与安全相关的方法

Detecting Security-Relevant Methods using Multi-label Machine Learning

Fraunhofer IEM(弗劳恩霍夫应用信息技术研究所);Amazon Web Services(亚马逊网络服务);Paderborn University(帕德博恩大学)

Oshando Johnson, Goran Piskachev, Ranjith Krishnamurthy, Eric Bodden

AI总结:

针对现有安全相关方法检测忽略标签依赖、手动配置静态分析工具繁琐的问题,提出考虑标签依赖的多标签机器学习插件Dev-Assist,其F1值更优且可减少人工配置工作量。

摘要:

为检测安全漏洞,静态分析工具需要配置与安全相关的方法。现有方法可使用二元关联机器学习方法自动识别此类方法,但它们忽略了安全相关方法之间的依赖关系,存在过度泛化问题,实际表现不佳。此外,用户仍需使用检测到的方法手动配置静态分析工具。根据用户反馈和我们的观察,过多的手动步骤通常繁琐、易出错且不符合直觉。\n 本文提出Dev-Assist,一款IntelliJ IDEA插件,它采用考虑标签间依赖关系的多标签机器学习方法检测安全相关方法。该插件可自动生成静态分析工具的配置、运行静态分析,并在IntelliJ IDEA中展示结果。我们的实验表明,Dev-Assist的机器学习方法的F1值高于相关方法。此外,该插件减少并简化了配置和使用静态分析工具所需的人工工作量。

英文摘要:

To detect security vulnerabilities, static analysis tools need to be configured with security-relevant methods. Current approaches can automatically identify such methods using binary relevance machine learning approaches. However, they ignore dependencies among security-relevant methods, over-generalize and perform poorly in practice. Additionally, users have to nevertheless manually configure static analysis tools using the detected methods. Based on feedback from users and our observations, the excessive manual steps can often be tedious, error-prone and counter-intuitive. In this paper, we present Dev-Assist, an IntelliJ IDEA plugin that detects security-relevant methods using a multi-label machine learning approach that considers dependencies among labels. The plugin can automatically generate configurations for static analysis tools, run the static analysis, and show the results in IntelliJ IDEA. Our experiments reveal that Dev-Assist's machine learning approach has a higher F1-Measure than related approaches. Moreover, the plugin reduces and simplifies the manual effort required when configuring and using static analysis tools.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑