Deep-Learning Vulnerability Detection Robustness Against Code Shifting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Deep-learning based source-code vulnerability detection models lack robustness against code shifting attacks, leading to high false negatives and false positives, as existing adversarial training methods are not suitable for structured programming languages.
Innovation Solution
A device comprising a code-converting module, a mapping module, and a neural-network module with two classifiers, which performs iterative optimization to decouple feature learning and train classifiers for improved robustness, reducing prediction differences and enhancing vulnerability detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If deep-learning based vulnerability detection is used, then detection accuracy is improved, but robustness against code shifting attacks deteriorates
Solution Approach 1:
The patent applies preliminary action by performing adversarial training before actual vulnerability detection. The model is pre-trained on code shifting samples to learn robust features that are invariant to code transformations. This preliminary exposure to adversarial examples enables the model to maintain high detection accuracy while becoming robust against code shifting attacks, resolving the contradiction between detection accuracy and robustness.
Solution Approach 2:
The patent implements preliminary anti-action by introducing code shifting attacks during the training phase to counteract their harmful effects during deployment. By training the model on adversarially perturbed code samples, the model learns to resist these attacks and maintain reliable detection performance. This preliminary counter-measure eliminates the vulnerability to code shifting while preserving detection accuracy.
2Reliability
If existing adversarial training methods are applied, then robustness is improved, but suitability for structured programming languages deteriorates
Solution Approach 1:
The patent applies local quality by adapting adversarial training methods specifically for structured programming languages rather than using generic image-based approaches. The implementation uses code-specific transformations such as variable renaming, statement reordering, and control flow modifications that preserve program semantics while changing code structure. This localized adaptation ensures robustness improvement while maintaining suitability for structured programming languages.
Solution Approach 2:
The patent implements parameter changes by modifying the adversarial training parameters to suit programming languages. Instead of pixel-level perturbations used in image processing, the patent uses code-level transformations with specific parameters such as transformation probability, perturbation magnitude, and semantic preservation constraints. These parameter adjustments make the adversarial training method suitable for structured programming languages while achieving robustness improvement.
Data Source
AI summary
The present invention relates a device for improving robustness of deep-learning based detection of source-code vulnerability, the device at least comprises a code-converting module, a mapping module, and a neural-network module, wherein the mapping module is in data connection with the code-converting module, the mapping module is in data connection with the neural-network module, respectively, and the neural-network module includes at least two first classifiers, based on a received first training program source code, the mapping module maps a plurality of code snippets, and the neural-network module trains the at least two first classifiers according to a first sample vector. The present invention improves the robustness of detection of source-code vulnerability by performing classification training on the feature generators and the classifiers.