Context-aware interpretable vulnerability detection system and method

Abstract

The invention discloses a context-aware interpretable vulnerability detection system, which comprises the following steps of: extracting vulnerability codes through an open source database to construct a first code attribute graph, constructing a detection model according to the first code attribute graph, performing code representation on vulnerability code statements, generating vulnerability prediction scores, and constructing an interpretation model according to the vulnerability prediction scores. And constructing a second code attribute graph, detecting a to-be-detected vulnerability code according to the second code attribute graph, finally outputting a local optimal sub-graph as a vulnerability detection result for interpretation, and parameterizing an interpretation generation process by an interpretation model by adopting a multi-layer neural network to realize collective interpretation of a plurality of instances. The invention correspondingly provides a context-aware interpretable vulnerability detection method.

Description

technical field [0001] The invention relates to the field of software security, in particular to a context-aware interpretable vulnerability detection system and method. Background technique [0002] Vulnerability detection methods are divided into program analysis-based and machine learning-based. According to existing research, the vulnerability detection method based on code similarity mainly detects vulnerabilities caused by code cloning, and the accuracy of vulnerability detection for non-code cloning caused by code cloning. Not high; rule-based vulnerability detection methods require human experts to define vulnerability characteristics, which is cumbersome and error-prone; vulnerability detection methods based on machine learning and deep learning have achieved success in recent years, but there are still many shortcomings. The learned vulnerability detection method VulDeePecker only utilizes the semantic information of data dependence, without considering the control...

AI Technical Summary

Problems solved by technology

[0002] Vulnerability detection methods are divided into program analysis-based and machine learning-based. According to existing research, the vulnerability detection method based on code similarity mainly detects the vulnerabilities caused by code cloning. Not high; rule-based vulnerability detection methods require human experts to define vulnerability characteristics, the process is cumbersome and error-prone; vulnerability detection methods based on machine learning and deep learning have achieved success in recent years, but there are still many deficiencies. The learned vulnerability detection method VulDeePecker only uses the semantic information dependent on the data, without considering the control dependence; the vulnerability detection method based on software metrics, and the code metrics are based on the overall properties of the program, so the correlation with the vulnerable code itself is not strong. Poor ability

[0003] The methods of explaining complex deep learning models can be divided into two categories: white box and black box. The white box mechanism focuses on providing an explanation for a single prediction. In the white box mechanism, methods based on forward and backward propagation are often used; Method Generates explanations to approximate predictions by locally learning an interpretable model and an additive model. Following the forward-propagation approach, the GNNExplainer explainer is used to study predictions for explaining graph-structured data, which excludes certain edge and node features to observe nodes or graphs. Variations of classification. In the GNNExplainer explainer, the explained subgraphs are extracted by maximizing the mutual information between the possible subgraph distributions and the GNN's predictions. However, similar to other forward propagation methods, the GNNExplainer explainer is a single Instance predictions generate explanations, which are not sufficient to provide a global explanation for the trained GNN model, and it is also difficult to provide explanations for multiple instances

Images