Method and system for detecting vulnerability of source code

Abstract

The present invention relates to a vulnerability detection technology of a source code, wherein a vulnerability detection device including a deep learning model can: receive input of an unlabeled source code dataset; pre-train a deep learning model on the basis of the source code dataset; receive input of target source codes for generating one or more gadgets for vulnerability detection; generate one or more source code gadgets on the basis of the one or more target source codes; input the one or more source code gadgets into the deep learning model; receive input of a detection target source code for detecting a vulnerability to determine and classify whether the detection target source code has a vulnerability on the basis of the one or more source code gadgets.

Description

Method and system for detecting vulnerabilities in source code

[0001] The present invention relates to a method and system for detecting vulnerabilities in source code, and more particularly, to a technology for determining the presence of vulnerabilities in target source code using a model pre-trained with general source code and a deep learning model trained in detail with code vulnerable to security and code that is not vulnerable.

[0002] Detecting security vulnerabilities that can potentially be exploited for security attacks is a well-known and fundamental problem in software security. Therefore, several static analysis techniques have been proposed to identify vulnerabilities in source code. However, these techniques primarily rely on databases of known vulnerable code patterns or rules, requiring expert knowledge to identify effective code patterns and rules. Consequently, these techniques are ineffective in detecting new vulnerable code patterns when expressions change.

[0003] Recently, machine learning-based techniques have been proposed to overcome these limitations. For example, while existing studies have shown that these techniques can achieve fewer false negatives than other approaches for security vulnerabilities, they fail to properly extract the source code itself for highly complex source code. Therefore, there is a need for techniques that can understand meaningful sequences of multiple commands within program source code and detect vulnerable source code patterns by considering highly repetitive command sequences.

[0004] The technical challenge that the embodiments of this specification seek to address is to propose a deep learning-based vulnerability detection technology using a natural language processing model. The technology receives general source code as input for pre-training, understands the overall command sequence within the source code, and aims to construct a pre-training dataset suitable for vulnerability detection. Furthermore, for detailed learning, the technology extracts meaningful command sequences within the input program source code to detect vulnerabilities in the source code. Furthermore, the technology aims to construct a detailed training dataset suitable for vulnerability detection based on the code fragments.

[0005] In order to solve the above technical problem, a method for detecting vulnerabilities in source code according to an embodiment of the present invention may include: a step in which a vulnerability detection device including a deep learning model receives an unlabeled source code dataset, and pre-trains the deep learning model based on the source code dataset; a step in which the vulnerability detection device receives target source code for generating one or more gadgets for vulnerability detection, and generates one or more source code gadgets based on the one or more target source codes; a step in which the vulnerability detection device inputs the one or more source code gadgets into the deep learning model, receives target source code for detecting a vulnerability, and determines whether the target source code for detection has a vulnerability based on the one or more source code gadgets and classifies the source code.

[0006] The step of pre-training the deep learning model according to one embodiment may perform tokenizing on a reference source code in the unlabeled source code dataset to generate one or more source code tokens.

[0007] The step of pre-training the deep learning model according to one embodiment may include: a step of generating a masked source code token by masking the one or more source code tokens, inputting the masked source code token into the deep learning model to predict and learn the masked source code token; a step of generating a replacement source code token by replacing some code in the one or more source code tokens, inputting the replacement source code token into the deep learning model to identify and learn the replaced some code in the replacement source code token; and a step of splitting the one or more source code tokens to generate a split source code token, inputting the split source code token into the deep learning model to identify and learn whether the code of the split source code token is a part of the reference source code.

[0008] The step of generating the one or more source code gadgets according to one embodiment may include the steps of: removing a string not composed of ASCII characters and a comment string from the target source code; specifying a name of a variable arbitrarily defined by the user in the target source code; and generating the one or more source code gadgets by specifying a name of a function arbitrarily defined by the user in the target source code and labeling the target source code as a vulnerable code gadget or a patch code gadget.

[0009] According to one embodiment, the step of determining whether there is a vulnerability in the source code to be detected and classifying the same may include the steps of: adding a special classification token in front of a code string in the one or more source code gadgets and adding a separator token after the code string in the one or more source code gadgets; generating a source code gadget to be detected based on the source code to be detected, adding the special classification token in front of the code string in the source code gadget to be detected, and adding a separator token after the code string in the source code gadget to be detected; and comparing the special classification token and the separator token between the source code gadget to be detected and the one or more source code gadgets to determine whether there is a vulnerability in the source code to be detected and classify the source code to be detected.

[0010] Furthermore, the following provides a computer-readable recording medium having recorded thereon a program for executing the vulnerability detection method of the source code described above on a computer.

[0011] In order to solve the above technical problem, a source code vulnerability detection device according to an embodiment of the present invention may include a processor; and a memory storing one or more commands to be executed by the processor, wherein the one or more commands include: a step of receiving an unlabeled source code dataset, and pre-training the deep learning model based on the source code dataset; a step of receiving target source code for generating one or more gadgets for vulnerability detection, and generating one or more source code gadgets based on the one or more target source codes; a step of inputting the one or more source code gadgets into the deep learning model, receiving target source code for detecting a vulnerability, and determining whether the target source code for detection has a vulnerability based on the one or more source code gadgets and classifying the detected source code.

[0012] The step of pre-training the deep learning model according to one embodiment may perform tokenizing on a reference source code in the unlabeled source code dataset to generate one or more source code tokens.

[0013] The step of pre-training the deep learning model according to one embodiment may include: a step of generating a masked source code token by masking the one or more source code tokens, inputting the masked source code token into the deep learning model to predict and learn the masked source code token; a step of generating a replacement source code token by replacing some code in the one or more source code tokens, inputting the replacement source code token into the deep learning model to identify and learn the replaced some code in the replacement source code token; and a step of splitting the one or more source code tokens to generate a split source code token, inputting the split source code token into the deep learning model to identify and learn whether the code of the split source code token is a part of the reference source code.

[0014] The step of generating the one or more source code gadgets according to one embodiment may include the steps of: removing a string not composed of ASCII characters and a comment string from the target source code; specifying a name of a variable arbitrarily defined by the user in the target source code; and generating the one or more source code gadgets by specifying a name of a function arbitrarily defined by the user in the target source code and labeling the target source code as a vulnerable code gadget or a patch code gadget.

[0015] According to one embodiment, the step of determining whether there is a vulnerability in the source code to be detected and classifying the same may include the steps of: adding a special classification token in front of a code string in the one or more source code gadgets and adding a separator token after the code string in the one or more source code gadgets; generating a source code gadget to be detected based on the source code to be detected, adding the special classification token in front of the code string in the source code gadget to be detected, and adding a separator token after the code string in the source code gadget to be detected; and comparing the special classification token and the separator token between the source code gadget to be detected and the one or more source code gadgets to determine whether there is a vulnerability in the source code to be detected and classify the source code to be detected.

[0016] In order to solve the above technical problem, a source code vulnerability detection system according to an embodiment of the present invention includes: a source code acquisition device that acquires a source code dataset, one or more gadget generation source codes, and target source codes; and a vulnerability detection device that receives the source code dataset, the one or more gadget generation source codes, and detection target source codes from the source code acquisition device, and determines whether there is a vulnerability in the target source codes through a deep learning model and classifies them; wherein the vulnerability detection device receives the unlabeled source code dataset, pre-trains the deep learning model based on the source code dataset, receives target source codes for generating the one or more gadgets for vulnerability detection, generates one or more source code gadgets based on the one or more target source codes, inputs the one or more source code gadgets into the deep learning model, receives the detection target source codes for which vulnerabilities are to be detected, and determines whether there is a vulnerability in the detection target source codes based on the one or more source code gadgets and classifies them.

[0017] In the case of pre-training the deep learning model according to one embodiment, tokenizing may be performed on a reference source code in the unlabeled source code dataset to generate one or more source code tokens.

[0018] In the case of pre-training the deep learning model according to one embodiment, by masking the one or more source code tokens, a masked source code token is generated, the masked source code token is input to the deep learning model to predict and learn the masked source code token, a replacement source code token is generated by replacing some code in the one or more source code tokens, the replacement source code token is input to the deep learning model to identify and learn the replaced some code in the replacement source code token, and the one or more source code tokens are split to generate a split source code token, and the split source code token is input to the deep learning model to identify and learn whether the code of the split source code token is a part of the reference source code.

[0019] When generating one or more source code gadgets according to one embodiment, the one or more source code gadgets may be generated by removing strings not composed of ASCII characters and comment strings from the target source code, specifying a name of a variable arbitrarily defined by the user in the target source code, specifying a name of a function arbitrarily defined by the user in the target source code, and labeling the target source code as a vulnerable code gadget or a patch code gadget.

[0020] In the case of determining whether or not there is a vulnerability in the detection target source code according to one embodiment and classifying it, a special classification token is added in front of a code string in the one or more source code gadgets, a separator token is added after a code string in the one or more source code gadgets, a detection target source code gadget is created based on the detection target source code, the special classification token is added in front of a code string in the detection target source code gadget, a separator token is added after a code string in the detection target source code gadget, and the special classification token and the separator token are compared between the detection target source code gadget and the one or more source code gadgets, thereby determining whether or not there is a vulnerability in the detection target source code and classifying it.

[0021] According to the embodiments of the present disclosure described above, by providing a deep learning-based vulnerability detection technology using a natural language processing model, it is possible to detect vulnerabilities by understanding meaningful command sequences within the input program source code and extracting and utilizing key sequences within the source code. Furthermore, vulnerable code fragments can be extracted based on the input program source code, and a detailed training data set suitable for vulnerability detection can be constructed based on the code fragments. This allows for reducing the size of the training data by inputting source code into the vulnerability detection model to extract code fragments that are likely to cause vulnerabilities without relying on expert knowledge by learning vulnerability types.

[0022] FIG. 1 is a block diagram illustrating a source code vulnerability detection system according to one embodiment of the present invention.

[0023] FIG. 2 is a diagram for explaining a method for pre-training a deep learning model according to one embodiment of the present invention.

[0024] FIG. 3 is a drawing for explaining a method for generating a source code gadget according to one embodiment of the present invention.

[0025] FIG. 4 is a diagram for explaining a method for determining and classifying vulnerabilities in source code according to one embodiment of the present invention.

[0026] FIG. 5 is a flowchart illustrating a method for detecting vulnerabilities in source code according to one embodiment of the present invention.

[0027] FIG. 6 is a block diagram illustrating a source code vulnerability detection device according to another embodiment of the present invention.

[0028] Hereinafter, embodiments of the present specification will be described in detail with reference to the drawings. However, detailed descriptions of well-known functions or components that may obscure the gist of the embodiments in the following description and the attached drawings will be omitted. Additionally, throughout the specification, the term "including" a component does not exclude other components, unless specifically stated otherwise, but rather implies the inclusion of other components.

[0029] Additionally, while terms such as "first" and "second" may be used to describe various components, the components should not be limited by these terms. Terms may be used to distinguish one component from another. For example, without departing from the scope of this specification, a first component may be referred to as a "second component," and similarly, a second component may also be referred to as a "first component."

[0030] The terminology used herein is for the purpose of describing specific embodiments only and is not intended to be limiting of the present disclosure. The singular expressions include plural expressions unless the context clearly dictates otherwise. In this application, it should be understood that the terms "comprise" or "have" indicate the presence of a described feature, number, step, operation, component, part, or combination thereof, but do not preclude the possibility of the presence or addition of one or more other features, numbers, steps, operations, components, parts, or combinations thereof.

[0031] Unless specifically defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by a person of ordinary skill in the art to which this specification pertains. Terms defined in commonly used dictionaries should be interpreted to have a meaning consistent with their meaning in the context of the relevant technology, and will not be interpreted in an idealized or overly formal sense unless explicitly defined herein.

[0032] FIG. 1 is a block diagram illustrating a source code vulnerability detection system according to one embodiment of the present invention.

[0033]

[0034] Referring to FIG. 1, a vulnerability detection system (10) according to one embodiment of the present invention may include a source code acquisition device (100) and a vulnerability detection device (200). In addition, the vulnerability detection system (10) may be connected to a network with a device that provides programs such as websites, web pages, and web applications, and open source code.

[0035] The source code acquisition device (100) can acquire a source code dataset containing multiple source codes or a single source code from programs and devices that provide source codes, such as websites, web pages, and web applications, and programs and devices that provide open source codes. In this case, the single source code may include a gadget creation source code and a target source code, which will be described later. The source code acquisition device (100) can transmit the acquired source code dataset and single source code to a vulnerability detection device (200), and each device can be connected to a network and communicate with each other.

[0036] The network referred to in the present invention may be a core network integrated with a wired public network, a wireless mobile communication network, or a mobile Internet, and may mean a global open computer network structure that provides various services existing in the TCP / IP protocol (Transmission Control Protocol), UDP (User Datagram Protocol) and its upper layer, namely, HTTP (Hyper Text Transfer Protocol), HTTPS (Hyper Text Transfer Protocol Secure), Telnet, FTP (File Transfer Protocol), DNS (Domain Name System), SMTP (Simple Mail Transfer Protocol), MQTT Protocol (Message Queueing Telemetry Transport), IPFS (Inter Planetary File System), and the like, and may comprehensively mean a data communication network that can transmit and receive data in various forms without being limited to these examples.

[0037] The vulnerability detection device (200) can receive a source code dataset and a single source code (e.g., source code for pre-learning or target source code) from the source code acquisition device (100).

[0038] The vulnerability detection device (200) may include a deep learning model or operate based on a deep learning model.

[0039] The vulnerability detection device (200) receives an unlabeled source code dataset, pre-trains a deep learning model based on the source code dataset, receives target source code for generating one or more gadgets for vulnerability detection, generates one or more source code gadgets based on the one or more target source codes, and determines and classifies whether the target source code has a vulnerability based on the one or more source code gadgets. The description of the operation of the vulnerability detection device (200) of Fig. 1 will be supplemented with the drawings described below.

[0040] Figure 2 is a diagram illustrating a method for pre-training a deep learning model according to one embodiment of the present invention. Figure 3 is a diagram illustrating a method for generating a source code gadget according to one embodiment of the present invention. Figure 4 is a diagram illustrating a method for identifying and classifying vulnerabilities in source code according to one embodiment of the present invention.

[0041] Referring to FIG. 2, the vulnerability detection device (200) can receive an unlabeled source code dataset and pre-train the deep learning model based on the source code dataset.

[0042] The vulnerability detection device (200) may include a deep learning model or operate based on a deep learning model. In this case, the deep learning model may be a BERT (Bidirectional Encoder Representations from Transformers) model, which is a large-scale natural language processing model, or a natural language processing model based on the BERT model.

[0043] Typically, natural language processing models have been used to accurately detect vulnerable source code patterns. However, a pre-trained natural language processing (NLP) model suitable for a specific task can outperform conventional source code pattern analysis (e.g., vulnerability detection in source code using a machine learning (ML) model and a pattern matching method). Accordingly, the deep learning model of the vulnerability detection device (200) can perform pre-training suitable for vulnerability detection in source code composed of the C and C++ languages.

[0044] The deep learning model of the vulnerability detection device (200) can efficiently manage the learning time used for pre-learning of the deep learning model and resolve the overfitting problem that produces inaccurate vulnerability source code results by refining a large-scale source code dataset.

[0045] The vulnerability detection device (200) may perform tokenization on the source code data set or the plurality of source codes in order to refine the input source code data set or the plurality of source codes. That is, the vulnerability detection device (200) may perform tokenization on a reference source code within an unlabeled source code data set to generate one or more source code tokens.

[0046] The vulnerability detection device (200) can pre-train a deep learning model through masked prediction, replaced code prediction, and original token prediction methods based on one or more generated source code tokens.

[0047] The vulnerability detection device (200) can perform mask token prediction, which is one of the methods for pre-training a deep learning model, by masking source code tokens at a certain ratio to generate masked source code tokens, and inputting the masked source code tokens into a deep learning model to predict and train the masked source code tokens. Through this, the deep learning model of the vulnerability detection device (200) can perform masking processing on tokenized source codes at a random ratio, and then, when a source code including a masked source code token is input, predict which token the corresponding token is, thereby performing random masked source code data prediction.

[0048] The vulnerability detection device (200) can perform replacement token prediction, which is one of the methods for pre-training a deep learning model, by replacing some codes in one or more source code tokens to generate replacement source code tokens, and inputting source codes including replacement source code tokens into a deep learning model to identify and train some of the replaced codes in the replacement source code tokens. That is, the deep learning model of the vulnerability detection device (200) can perform random replacement source code data prediction, which predicts whether codes in the corresponding tokens have been replaced when the replaced source code tokens are input after replacing codes of the tokenized source codes at a random ratio.

[0049] The vulnerability detection device (200) can perform prediction of source code tokens of the same source, which is one of the methods for pre-training a deep learning model, by randomly splitting one or more source code tokens to generate split source code tokens, and inputting randomly selected split source code tokens into a deep learning model to identify and train whether the split source code tokens are extracted from the same reference source code. That is, the deep learning model of the vulnerability detection device (200) can perform predictions for understanding the context of the source code by splitting tokenized source codes at a random ratio and then, when inputting split source code tokens, predicting whether the input tokens are extracted from the same source code.

[0050] Referring to FIG. 3, the vulnerability detection device (200) can receive target source code for generating one or more gadgets for vulnerability detection, and generate one or more source code gadgets based on one or more target source codes.

[0051] The vulnerability detection device (200) can calculate program slices related to system function calls extracted from the input target source code to generate a source code gadget. In this case, the source code gadget may be a form in which the main code is collected from the original source code.

[0052] The vulnerability detection device (200) can remove strings that are not composed of ASCII characters and strings composed of comments from the target source code to calculate a program slice. Thereafter, the vulnerability detection device (200) can collect program slices related to a specified system function call (e.g., free(data)) and perform program slicing in the reverse direction to identify data variables related to the system function call. For example, referring to FIG. 3, since the code lines related to the data variables exist in the free_fun function and the main function, the vulnerability detection device (200) can identify data variables related to free(data) by targeting the free_fun function and the main function.

[0053] The vulnerability detection device (200) can collect program slices related to free(data) by repeating the aforementioned reverse program slicing process. Accordingly, the vulnerability detection device (200) can generate a source code gadget in which non-ASCII character strings and comment strings are removed from one or more gadget generation source codes.

[0054] The vulnerability detection device (200) can convert the specific program code of the program slice into a generalized expression that can be input to a deep learning model, targeting the gadget generation source code from which strings not composed of ASCII characters and comment strings are removed, in order to generate a source code gadget.

[0055] In general, in analyzing the source code of a program, user-specified functions, variables, comments, strings, and constant values ​​may not be important. Therefore, the vulnerability detection device (200) can designate variables and functions arbitrarily defined by the user as generalized expressions. The vulnerability detection device (200) can designate functions (free_fun) or variables (data) arbitrarily defined by the user as generalized expressions (FUNi and VARi) for the gadget generation source code from which strings and comment strings that are not composed of ASCII characters have been removed, while preserving the function names for system function calls (e.g., malloc, fread, and memset, etc.). At this time, the i-th sorted variable in the program source code can be designated as VARi, and the i-th sorted function can be designated as FUNi.

[0056] The vulnerability detection device (200) can generate a source code gadget by specifying a label from a target source code in which non-ASCII character strings and comment strings are removed and names of variables and functions arbitrarily defined by the user are specified, in order to generate a label for the source code gadget. The label of the target source code is classified as a security-vulnerable source code or a safe source code, and can be generated together with the corresponding target source code information. At this time, the target source code information may be source code collected from the National Vulnerability Database (NVD) and the Software Assurance Reference Dataset (SARD). That is, the vulnerability detection device (200) can generate one or more source code gadgets by specifying a name of a variable arbitrarily defined by the user in the target source code, specifying a name of a function arbitrarily defined by the user in the target source code, and labeling the target source code as a vulnerable code gadget corresponding to the security-vulnerable source code or a patch code gadget corresponding to the safe source code.

[0057] The source code gadget generated through the vulnerability detection device (200) can overcome the problem of not being able to process nested function calls by tracing k-level nested function calls from the main function in the process of calculating a program slice related to a system function call.

[0058] Referring to FIG. 4, the vulnerability detection device (200) generates one or more source code gadgets and inputs them into a deep learning model, receives a detection target source code for which a vulnerability is to be detected, and determines whether the target source code has a vulnerability based on one or more source code gadgets and classifies the source code.

[0059] The vulnerability detection device (200) inputs one or more generated source code gadgets into a deep learning model, and adds a special classification token (CLS) indicating the starting point of the input vector to the code within the generated source code gadget, and adds a separator token (SEP) indicating the ending point of the input vector to the code within the generated source code gadget.

[0060] The vulnerability detection device (200) encodes the generated source code gadget and provides it as input to a deep learning model, thereby adjusting the parameters of the deep learning model to identify security vulnerabilities in the code of the generated source code gadget.

[0061] The vulnerability detection device (200) can detect security vulnerabilities in the input detection target source code to detect vulnerabilities through a deep learning model with adjusted parameters. The vulnerability detection device (200) can generate a detection target source code gadget using the same method as the source code gadget generation method of FIG. 3. In addition, the vulnerability detection device (200) can add special classification tokens and separation tokens to the code in the generated detection target source code gadget through the deep learning model.

[0062] The vulnerability detection device (200) can detect special classification tokens and separation tokens corresponding to security-vulnerable source codes through a deep learning model based on the code in the generated detection target source code gadget. The deep learning model of the vulnerability detection device (200) obtains input vectors corresponding to special classification tokens and separation tokens in the detection target source code gadget, and if the input vector is an input vector corresponding to a vulnerable code gadget, the device can classify the detection target source code as security-vulnerable source codes and identify the location of vulnerabilities in the detection target source code.

[0063] Accordingly, the vulnerability detection device (200) can add a special classification token in front of a code string in one or more source code gadgets, add a separator token after a code string in one or more source code gadgets, create a detection target source code gadget based on the detection target source code, add the special classification token in front of the code string in the detection target source code gadget, add the separator token after the code string in the detection target source code gadget, and compare the special classification token and the separator token between the detection target source code gadget and one or more source code gadgets, thereby determining whether the detection target source code has a vulnerability and classifying it.

[0064] FIG. 5 is a flowchart illustrating a method for detecting vulnerabilities in source code according to one embodiment of the present invention.

[0065] Referring to FIG. 5, a vulnerability detection device including a deep learning model can receive an unlabeled source code dataset and pre-train the deep learning model based on the source code dataset (S410). The vulnerability detection device (e.g., the vulnerability detection device (200) of FIG. 1) can receive the source code dataset from a source code acquisition device (e.g., the source code acquisition device (100) of FIG. 1). In addition, the vulnerability detection device can receive a gadget generation source code and a target source code from the source code acquisition device.

[0066] In one embodiment, the vulnerability detection device may perform tokenization on a reference source code within the unlabeled source code dataset to generate one or more source code tokens.

[0067] In one embodiment, the vulnerability detection device generates a masking source code token by masking the one or more source code tokens, inputs the reference source code and the masking source code token into the deep learning model to learn that the masking source code token is a part of the reference source code, replaces a part of code in the one or more source code tokens to generate a replacement source code token, inputs the reference source code and the replacement source code token into the deep learning model to identify and learn the part of code replaced in the replacement source code token, splits the one or more source code tokens to generate a split source code token, and inputs the reference source code and the split source code token into the deep learning model to identify and learn whether the code of the split source code token is a part of the reference source code.

[0068] A vulnerability detection device can receive one or more gadget generation source codes for vulnerability detection and generate one or more source code gadgets based on the one or more gadget generation source codes (S430).

[0069] In one embodiment, the vulnerability detection device can generate the one or more source code gadgets by removing non-ASCII character strings and comment strings from the one or more gadget generation source codes, specifying a name of a variable arbitrarily defined by the user in the one or more gadget generation source codes, specifying a name of a function arbitrarily defined by the user in the one or more gadget generation source codes, and labeling the one or more gadget generation source codes as a vulnerable code gadget or a patch code gadget.

[0070] The vulnerability detection device can input one or more of the source code gadgets into the deep learning model, receive the target source code for which a vulnerability is to be detected, and classify the target source code by determining whether or not there is a vulnerability based on the one or more of the source code gadgets (S450).

[0071] In one embodiment, the vulnerability detection device adds a special classification token in front of a code string in the one or more source code gadgets, adds a separator token after a code string in the one or more source code gadgets, creates a target source code gadget based on the target source code, adds the special classification token in front of the code string in the target source code gadget, adds the separator token after the code string in the target source code gadget, and compares the special classification token and the separator token between the target source code gadget and the one or more source code gadgets, thereby determining whether the target source code has a vulnerability and classifying it.

[0072] FIG. 6 is a block diagram illustrating a source code vulnerability detection device according to another embodiment of the present invention.

[0073] The vulnerability detection device (300) of FIG. 6 may be the same as the vulnerability detection device (200) of FIG. 1. The vulnerability detection device (300) may include at least one processor (310), a memory (320), and a transmission / reception device (330) that is connected to a network and performs communication. In addition, the vulnerability detection device (300) may further include an input interface device (340), an output interface device (350), a storage device (360), etc. Each component included in the vulnerability detection device (300) may be connected by a bus (370) to communicate with each other. However, each component included in the vulnerability detection device (300) may be connected through individual interfaces or individual buses centered around the processor (310), rather than a common bus (370). For example, the processor (310) may be connected to at least one of a memory (320), a transceiver (330), an input interface device (340), an output interface device (350), and a storage device (360) via a dedicated interface.

[0074] The processor (310) can execute program commands stored in at least one of the memory (320) and the storage device (360). The processor (310) may refer to a central processing unit (CPU), a graphics processing unit (GPU), or a dedicated processor in which methods according to embodiments of the present invention are performed. Each of the memory (320) and the storage device (360) may be configured with at least one of a volatile storage medium and a non-volatile storage medium. For example, the memory (320) may be configured with at least one of a read-only memory (ROM) and a random access memory (RAM).

[0075] According to the embodiments of the present disclosure described above, a deep learning-based vulnerability detection technology is provided using a natural language processing model, thereby enabling detection of vulnerabilities in source code by understanding meaningful command sequences and highly repetitive command sequences within the input program source code. Furthermore, vulnerable code fragments can be extracted based on the input program source code, and a pre-training data set suitable for vulnerability detection can be constructed based on these code fragments. This allows for reducing the amount of training data by inputting source code into a vulnerability detection model to extract code fragments that are likely to cause vulnerabilities without relying on expert knowledge, thereby learning vulnerability types.

[0076] Embodiments according to the present specification may be implemented by various means, for example, hardware, firmware, software, or a combination thereof. In the case of hardware implementation, an embodiment of the present specification may be implemented by one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), processors, controllers, microcontrollers, microprocessors, etc. In the case of firmware or software implementation, an embodiment of the present specification may be implemented in the form of a module, procedure, function, etc. that performs the capabilities or operations described above. Software code may be stored in a memory and executed by a processor. The memory may be located inside or outside the processor and may exchange data with the processor by various means already known in the art.

[0077] Meanwhile, the embodiments of the present disclosure can be implemented as computer-readable codes on a computer-readable recording medium. Computer-readable recording media include all types of recording devices that store data that can be read by a computer system. Examples of computer-readable recording media include ROMs, RAMs, CD-ROMs, magnetic tapes, floppy disks, optical data storage devices, etc. Furthermore, the computer-readable recording media can be distributed across network-connected computer systems, so that the computer-readable codes can be stored and executed in a distributed manner. In addition, functional programs, codes, and code segments for implementing the embodiments can be easily inferred by programmers in the technical field to which the present disclosure pertains.

[0078] The present disclosure has been described above, focusing on various embodiments thereof. Those skilled in the art will appreciate that various embodiments may be modified without departing from the essential characteristics of the present disclosure. Therefore, the disclosed embodiments should be considered illustrative rather than restrictive. The scope of the present disclosure is set forth in the claims, not the foregoing description, and all differences within the scope equivalent thereto should be construed as being encompassed by the present disclosure.

[0079] While most terms used in this invention are commonly used in the field, some terms were arbitrarily selected by the applicant, and their meanings are described in detail in the following description, as needed. Therefore, the present invention should be understood based on the intended meaning of the terms, not simply their names or meanings.

[0080] It will be apparent to those skilled in the art that the present invention can be embodied in other specific forms without departing from the essential characteristics thereof. Therefore, the above detailed description should not be construed as limiting in any respect, but rather as illustrative. The scope of the present invention should be determined by a reasonable interpretation of the appended claims, and all modifications within the scope of equivalents of the present invention are intended to be included within the scope of the present invention.

Claims

1. A vulnerability detection device including a deep learning model receives an unlabeled source code dataset and pre-trains the deep learning model based on the source code dataset; A step for the vulnerability detection device to receive target source code for generating one or more gadgets for vulnerability detection and generate one or more source code gadgets based on the one or more target source codes; and A vulnerability detection method comprising: a step of inputting the one or more source code gadgets into the deep learning model by the vulnerability detection device, receiving the detection target source code for which a vulnerability is to be detected, and classifying the detection target source code based on the one or more source code gadgets to determine whether there is a vulnerability.

2. In paragraph 1, The step of pre-training the above deep learning model is: A vulnerability detection method that generates one or more source code tokens by performing tokenization on a reference source code within the above unlabeled source code dataset.

3. In paragraph 2, The step of pre-training the above deep learning model is: A step of generating a masking source code token by masking one or more of the source code tokens, and inputting the masking source code token into the deep learning model to predict and learn the masking source code token; A step of generating a replacement source code token by replacing some code in the one or more source code tokens, and inputting the replacement source code token into the deep learning model to identify and learn the replaced some code in the replacement source code token; and A vulnerability detection method comprising: a step of generating a split source code token by splitting one or more source code tokens, inputting the split source code token into the deep learning model, and learning by identifying whether the code of the split source code token is part of the reference source code.

4. In paragraph 1, The step of generating one or more of the above source code gadgets comprises: A step of removing strings and comment strings that are not composed of ASCII characters from the above target source code; A step of specifying a name of a variable arbitrarily defined by the user in the above target source code; and A vulnerability detection method comprising: a step of generating one or more source code gadgets by specifying a name of a function arbitrarily defined by a user in the target source code and labeling the target source code as a vulnerable code gadget or a patch code gadget.

5. In paragraph 1, The step of classifying the presence or absence of vulnerabilities in the source code to be detected is as follows: A step of adding a special classification token in front of a code string in the one or more source code gadgets and adding a separator token after the code string in the one or more source code gadgets; A step of creating a detection target source code gadget based on the detection target source code, adding a special classification token in front of the code string in the detection target source code gadget, and adding a separation token after the code string in the detection target source code gadget; and A vulnerability detection method comprising a step of classifying the presence or absence of a vulnerability in the detection target source code by comparing a special classification token and a separation token between the detection target source code gadget and the one or more source code gadgets.

6. A computer-readable recording medium having recorded thereon a program for executing the method of any one of clauses 1 to 5 on a computer.

7. In a vulnerability detection device including a deep learning model, processor; and A memory in which one or more instructions to be executed by the processor are stored, One or more of the above commands, A step of inputting an unlabeled source code dataset and pre-training the deep learning model based on the source code dataset; A step of receiving target source code for generating one or more gadgets for vulnerability detection and generating one or more source code gadgets based on the one or more target source codes; and A vulnerability detection device comprising a step of inputting one or more source code gadgets into the deep learning model, receiving a detection target source code for which a vulnerability is to be detected, and classifying the detection target source code based on the one or more source code gadgets to determine whether or not there is a vulnerability in the detection target source code.

8. In paragraph 7, The step of pre-training the above deep learning model is: A vulnerability detection device that generates one or more source code tokens by tokenizing a reference source code within the above unlabeled source code dataset.

9. In paragraph 8, The step of pre-training the above deep learning model is: A step of generating a masking source code token by masking one or more of the source code tokens, and inputting the masking source code token into the deep learning model to predict and learn the masking source code token; A step of generating a replacement source code token by replacing some code in the one or more source code tokens, and inputting the replacement source code token into the deep learning model to identify and learn the replaced some code in the replacement source code token; and A vulnerability detection device comprising: a step of generating a split source code token by splitting one or more source code tokens, and inputting the split source code token into the deep learning model to identify and learn whether the code of the split source code token is part of the reference source code.

10. In paragraph 7, The step of generating one or more of the above source code gadgets comprises: A step of removing strings and comment strings that are not composed of ASCII characters from the above target source code; A step of specifying a name of a variable arbitrarily defined by the user in the above target source code; and A vulnerability detection device comprising a step of generating one or more source code gadgets by specifying a name of a function arbitrarily defined by a user in the target source code and labeling the target source code as a vulnerable code gadget or a patch code gadget.

11. In paragraph 7, The step of classifying the presence or absence of vulnerabilities in the source code to be detected is as follows: A step of adding a special classification token in front of a code string in the one or more source code gadgets and adding a separator token after the code string in the one or more source code gadgets; A step of creating a detection target source code gadget based on the detection target source code, adding a special classification token in front of the code string in the detection target source code gadget, and adding a separation token after the code string in the detection target source code gadget; and A vulnerability detection device comprising a step of classifying the presence or absence of a vulnerability in the detection target source code by comparing a special classification token and a separation token between the detection target source code gadget and the one or more source code gadgets.

12. A source code acquisition device that acquires a source code dataset, one or more gadget generation source codes, and target source codes; and A vulnerability detection device that receives the source code dataset, the one or more gadget creation source codes, and the detection target source code from the source code acquisition device, and classifies the target source code by determining whether there is a vulnerability in the target source code through a deep learning model; The above vulnerability detection device, A vulnerability detection system that receives an unlabeled source code dataset, pre-trains the deep learning model based on the source code dataset, receives target source code for generating one or more gadgets for vulnerability detection, generates one or more source code gadgets based on the one or more target source codes, inputs the one or more source code gadgets into the deep learning model, receives the detection target source code for which a vulnerability is to be detected, and classifies the detection target source code by determining whether or not there is a vulnerability based on the one or more source code gadgets.

13. In paragraph 12, When pre-training the above deep learning model, A vulnerability detection system that generates one or more source code tokens by tokenizing reference source code within the above unlabeled source code dataset.

14. In paragraph 13, When pre-training the above deep learning model, A vulnerability detection system that generates a masked source code token by masking one or more source code tokens, inputs the masked source code token into the deep learning model to predict and learn the masked source code token, replaces some code in the one or more source code tokens to generate a replacement source code token, inputs the replacement source code token into the deep learning model to identify and learn the replaced some code in the replacement source code token, splits the one or more source code tokens to generate a split source code token, inputs the split source code token into the deep learning model to identify and learn whether the code of the split source code token is a part of the reference source code.

15. In paragraph 12, When creating one or more of the above source code gadgets, A vulnerability detection system that generates one or more source code gadgets by removing non-ASCII character strings and comment strings from the target source code, specifying a name of a variable arbitrarily defined by the user in the target source code, specifying a name of a function arbitrarily defined by the user in the target source code, and labeling the target source code as a vulnerable code gadget or a patch code gadget.

16. In paragraph 12, When classifying the presence or absence of vulnerabilities in the source code to be detected above, A vulnerability detection system that adds a special classification token in front of a code string in one or more of the source code gadgets, adds a separator token after a code string in the one or more of the source code gadgets, creates a detection target source code gadget based on the detection target source code, adds the special classification token in front of the code string in the detection target source code gadget, adds the separator token after the code string in the detection target source code gadget, and compares the special classification token and the separator token between the detection target source code gadget and the one or more of the source code gadgets to determine whether the detection target source code has a vulnerability and classifies it.

Images