ML-Based Global Variable Vulnerability Detection From Execution Logs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software vulnerability detection tools face challenges in accurately identifying defects related to variable usage, particularly with global variables, due to compiler initialization issues and high overhead in dynamic verification, leading to false alarms and undetected defects.
Innovation Solution
A method and device using machine learning models to preprocess execution logs, classify initialization locations, and estimate variable values, determining vulnerabilities based on initialization and value ranges, reducing false positives and improving detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If static analysis is used to detect software vulnerabilities, then detection can be performed without execution, but false alarms increase and accuracy decreases
Solution Approach 1:
The patent performs preliminary static analysis to identify potential vulnerability locations in the source code before execution. This preliminary action creates a set of candidate locations that are then verified through dynamic execution, combining the speed of static analysis with the accuracy of dynamic verification to reduce false alarms while maintaining efficient detection time.
2Measurement precision
If dynamic verification is used to detect defects based on actual execution, then detection accuracy improves, but overhead increases significantly due to information collection and execution tracking
Solution Approach 1:
The patent segments the verification process into two distinct phases: static analysis phase that identifies candidate vulnerability locations without execution, and dynamic verification phase that only executes and monitors the specific candidate locations identified in the first phase. This segmentation reduces the overall overhead by avoiding comprehensive dynamic monitoring of all code paths while maintaining high detection accuracy through targeted verification.
3Reliability
If comprehensive monitoring of all variable usage locations is performed to detect variable defects, then detection coverage improves, but overhead becomes very significant
Solution Approach 1:
The patent performs preliminary static analysis to identify and filter candidate locations where variable defects are likely to occur before dynamic execution. This preliminary action creates a focused set of monitoring targets, allowing the system to achieve comprehensive coverage of actual vulnerability locations while significantly reducing overhead by not monitoring all possible variable usage locations during execution.
4Ease of manufacture
If traditional detection methods are used for global variables, then compiler initialization is assumed, but defects remain undetected when wrong initialization values are assigned
Solution Approach 1:
The patent implements feedback mechanisms during dynamic execution that actually observe and record the initialization values assigned to global variables at runtime. This feedback allows the system to detect when incorrect initialization values are assigned, overcoming the limitation of traditional methods that only assume compiler initialization. The feedback from actual execution provides precise information about initialization defects while maintaining relative simplicity through automated monitoring.
Data Source
AI summary
Provided are a device and method for detecting a variable vulnerability in software using a machine learning (ML) model. The method performed by an analysis device includes receiving a source code of a program to be analyzed, replacing call functions, variable names, and call stack functions in an execution log generated during execution of the source code with certain identifiers (IDs) to preprocess the execution log, analyzing the preprocessed execution log through a pretrained first learning model to classify whether each pair of a global variable and a call function is at an initialization location, analyzing the preprocessed execution log through a pretrained second learning model to estimate a maximum value and a minimum value of the global variable, and determining whether the global variable is vulnerable on the basis of information output by the first learning model and information output by the second learning model.