Context-aware interpretable vulnerability detection system and method

Abstract

The invention discloses a context-aware interpretable vulnerability detection system, which comprises the following steps of: extracting vulnerability codes through an open source database to construct a first code attribute graph, constructing a detection model according to the first code attribute graph, performing code representation on vulnerability code statements, generating vulnerability prediction scores, and constructing an interpretation model according to the vulnerability prediction scores. And constructing a second code attribute graph, detecting a to-be-detected vulnerability code according to the second code attribute graph, finally outputting a local optimal sub-graph as a vulnerability detection result for interpretation, and parameterizing an interpretation generation process by an interpretation model by adopting a multi-layer neural network to realize collective interpretation of a plurality of instances. The invention correspondingly provides a context-aware interpretable vulnerability detection method.

Description

technical field [0001] The invention relates to the field of software security, in particular to a context-aware interpretable vulnerability detection system and method. Background technique [0002] Vulnerability detection methods are divided into program analysis-based and machine learning-based. According to existing research, the vulnerability detection method based on code similarity mainly detects vulnerabilities caused by code cloning, and the accuracy of vulnerability detection for non-code cloning caused by code cloning. Not high; rule-based vulnerability detection methods require human experts to define vulnerability characteristics, which is cumbersome and error-prone; vulnerability detection methods based on machine learning and deep learning have achieved success in recent years, but there are still many shortcomings. The learned vulnerability detection method VulDeePecker only utilizes the semantic information of data dependence, without considering the control...

AI Technical Summary

Problems solved by technology

[0002] Vulnerability detection methods are divided into program analysis-based and machine learning-based. According to existing research, the vulnerability detection method based on code similarity mainly detects the vulnerabilities caused by code cloning. Not high; rule-based vulnerability detection methods require human experts to define vulnerability characteristics, the process is cumbersome and error-prone; vulnerability detection methods based on machine learning and deep learning have achieved success in recent years, but there are still many deficiencies. The learned vulnerability detection method VulDeePecker only uses the semantic information dependent on the data, without considering the control dependence; the vulnerability detection method based on software metrics, and the code metrics are based on the overall properties of the program, so the correlation with the vulnerable code itself is not strong. Poor ability

[0003] The methods of explaining complex deep learning models can be divided into two categories

Images