Java vulnerability detection positioning method based on GGNN and hierarchical attention network

Abstract

The invention discloses a Java vulnerability detection and positioning method based on a GGNN and a hierarchical attention network. The method mainly comprises the steps of vulnerability data set construction, data set preprocessing, model design and training, and model testing and evaluation. Firstly, a data set used in the current field is summarized, and a self-made data set for subsequent model training is designed and collected; performing data preprocessing work on the data set to obtain a primary representation of a code and enabling the primary representation to serve as input of a subsequent model; training a self-defined vulnerability detection model by using the preprocessed data; and finally, the trained model can process a tested data set, and test evaluation is given. Compared with the prior art, the method has the advantages that vulnerability detection is carried out by using the graph neural network model of the DL algorithm (optimization algorithm), and the problems of lack of data sets, poor interpretability and difficulty in code graph structure generation of this kind of research are solved.

Description

technical field [0001] The invention relates to the technical field of software detection, in particular to a static detection method for Java vulnerabilities based on deep learning. Background technique [0002] With the rapid increase in the number of software and the widespread use of open source software OSS, the number of software vulnerabilities and the impact of vulnerabilities are also increasing and expanding. Software loopholes will pose a potential threat to the safe operation of computers, and bring huge economic losses and serious information leakage to people and society. The "Heartbleed" loophole that has appeared is a vivid example. An effective way to alleviate the problem of software vulnerabilities is to use various means to detect possible vulnerabilities as early as possible before the software is released. [0003] In recent years, with the breakthrough of machine learning research, many studies have tried to use machine learning technology to automati...

AI Technical Summary

Problems solved by technology

Although the current vulnerability detection method based on DL algorithm has achieved the effect that previous work did not have, it also faces many bottlenecks that need to be broken through, such as the inherent poor interpretability of DL models, the lack of high-quality data sets, how to effectively extract the abstract features of vulnerabilities, etc. difficult problem; although many studies claim that their datasets are collected in the real world, most studies do not disclose their datasets, and vulnerability datasets with strict granularity are lacking.

In addition, the research on vulnerability detection based on graph neural network will reduce the amount of data and increase the complexity of the research because the source code needs to be compiled to generate the graph structure; Poor explanatory ability, unable to quickly locate vulnerabilities

Images