Automated Vulnerability Detection in Source Code Using Deep Representation Learning
Authors:
Rebecca L. Russell,
Louis Kim,
Lei H. Hamilton,
Tomo Lazovich,
Jacob A. Harer,
Onur Ozdemir,
Paul M. Ellingwood,
Marc W. McConley
Abstract:
Increasing numbers of software vulnerabilities are discovered every year whether they are reported publicly or discovered internally in proprietary code. These vulnerabilities can pose serious risk of exploit and result in system compromise, information leaks, or denial of service. We leveraged the wealth of C and C++ open-source code available to develop a large-scale function-level vulnerability…
▽ More
Increasing numbers of software vulnerabilities are discovered every year whether they are reported publicly or discovered internally in proprietary code. These vulnerabilities can pose serious risk of exploit and result in system compromise, information leaks, or denial of service. We leveraged the wealth of C and C++ open-source code available to develop a large-scale function-level vulnerability detection system using machine learning. To supplement existing labeled vulnerability datasets, we compiled a vast dataset of millions of open-source functions and labeled it with carefully-selected findings from three different static analyzers that indicate potential exploits. The labeled dataset is available at: https://osf.io/d45bw/. Using these datasets, we developed a fast and scalable vulnerability detection tool based on deep feature representation learning that directly interprets lexed source code. We evaluated our tool on code from both real software packages and the NIST SATE IV benchmark dataset. Our results demonstrate that deep feature representation learning on source code is a promising approach for automated software vulnerability detection.
△ Less
Submitted 27 November, 2018; v1 submitted 11 July, 2018;
originally announced July 2018.
Automated software vulnerability detection with machine learning
Authors:
Jacob A. Harer,
Louis Y. Kim,
Rebecca L. Russell,
Onur Ozdemir,
Leonard R. Kosta,
Akshay Rangamani,
Lei H. Hamilton,
Gabriel I. Centeno,
Jonathan R. Key,
Paul M. Ellingwood,
Erik Antelman,
Alan Mackay,
Marc W. McConley,
Jeffrey M. Opper,
Peter Chin,
Tomo Lazovich
Abstract:
Thousands of security vulnerabilities are discovered in production software each year, either reported publicly to the Common Vulnerabilities and Exposures database or discovered internally in proprietary code. Vulnerabilities often manifest themselves in subtle ways that are not obvious to code reviewers or the developers themselves. With the wealth of open source code available for analysis, the…
▽ More
Thousands of security vulnerabilities are discovered in production software each year, either reported publicly to the Common Vulnerabilities and Exposures database or discovered internally in proprietary code. Vulnerabilities often manifest themselves in subtle ways that are not obvious to code reviewers or the developers themselves. With the wealth of open source code available for analysis, there is an opportunity to learn the patterns of bugs that can lead to security vulnerabilities directly from data. In this paper, we present a data-driven approach to vulnerability detection using machine learning, specifically applied to C and C++ programs. We first compile a large dataset of hundreds of thousands of open-source functions labeled with the outputs of a static analyzer. We then compare methods applied directly to source code with methods applied to artifacts extracted from the build process, finding that source-based models perform better. We also compare the application of deep neural network models with more traditional models such as random forests and find the best performance comes from combining features learned by deep models with tree-based models. Ultimately, our highest performing model achieves an area under the precision-recall curve of 0.49 and an area under the ROC curve of 0.87.
△ Less
Submitted 2 August, 2018; v1 submitted 14 February, 2018;
originally announced March 2018.
