[论文解读] Predicting Vulnerability In Large Codebases With Deep Code Representation

Anshul Tanwar, Krishna Sundaresan+4 more|arXiv (Cornell University)|Apr 24, 2020

Software Engineering Research参考文献 5被引用 8

一句话总结

本文提出一种由人工智能驱动的系统，利用抽象语法树（AST）的深度学习表征及主动反馈回路，在软件开发过程中实时预测安全漏洞和代码缺陷。作为IDE插件集成，该系统能够识别具有已知问题的相似历史代码片段，使开发人员能够在生产代码中引入这些问题之前预防重复性错误和漏洞。

ABSTRACT

Currently, while software engineers write code for various modules, quite often, various types of errors - coding, logic, semantic, and others (most of which are not caught by compilation and other tools) get introduced. Some of these bugs might be found in the later stage of testing, and many times it is reported by customers on production code. Companies have to spend many resources, both money and time in finding and fixing the bugs which would have been avoided if coding was done right. Also, concealed flaws in software can lead to security vulnerabilities that potentially allow attackers to compromise systems and applications. Interestingly, same or similar issues/bugs, which were fixed in the past (although in different modules), tend to get introduced in production code again. We developed a novel AI-based system which uses the deep representation of Abstract Syntax Tree (AST) created from the source code and also the active feedback loop to identify and alert the potential bugs that could be caused at the time of development itself i.e. as the developer is writing new code (logic and/or function). This tool integrated with IDE as a plugin would work in the background, point out existing similar functions/code-segments and any associated bugs in those functions. The tool would enable the developer to incorporate suggestions right at the time of development, rather than waiting for UT/QA/customer to raise a defect. We assessed our tool on both open-source code and also on Cisco codebase for C and C++ programing language. Our results confirm that deep representation of source code and the active feedback loop is an assuring approach for predicting security and other vulnerabilities present in the code.

研究动机与目标

• 解决在开发过程中出现但直到测试后期或生产环境中才被发现的未检测到的软件错误和安全漏洞的问题。
• 通过在编码阶段而非部署后识别潜在问题，降低缺陷修复的成本和工作量。
• 利用历史错误数据从过往代码变更中防止类似问题在新代码中重复出现。
• 开发一种实时、集成于IDE的系统，通过深度代码表征主动提醒开发人员潜在漏洞。
• 展示将AST上的深度学习与反馈机制相结合，在大规模C/C++代码库中进行漏洞预测的有效性。

提出的方法

• 使用从源代码中提取的抽象语法树（AST）训练神经网络，构建深度代码表征。
• 采用孪生神经网络架构，基于AST结构学习代码片段之间的语义相似性。
• 实施主动反馈回路，从过往修复中学习，并将相似代码模式与已知漏洞相关联。
• 在历史代码变更数据上训练模型，包括错误修复，以识别与安全缺陷相关的模式。
• 将模型作为实时IDE插件集成，实时分析编写中的代码并提示潜在问题。
• 使用迁移学习和微调技术，将模型适配至特定代码库，如思科的C/C++代码库。

实验结果

研究问题

• RQ1 深度学习的AST表征能否有效预测大规模代码库中的安全漏洞？
• RQ2 在多大程度上可以利用过往错误修复来预测新代码中类似的漏洞？
• RQ3 主动反馈回路在提升开发过程中漏洞预测的准确性和相关性方面有多有效？
• RQ4 与传统测试方法相比，该系统是否能更早地检测到漏洞？
• RQ5 该模型在不同代码库（包括开源和企业级软件）上的泛化能力如何？

主要发现

• 该系统通过从历史错误修复中学习，成功识别出易出问题的代码模式，降低了重复引入缺陷的可能性。
• 深度AST表征能够捕捉代码段之间的语义和结构相似性，从而实现对类似漏洞的准确检测。
• 主动反馈回路的集成显著提升了预测准确性，通过整合开发者反馈和历史修复记录实现。
• 该模型在开源和企业级代码库（包括思科的C/C++代码库）中均表现出色。
• IDE中的实时分析使开发人员能够立即处理潜在漏洞，显著降低发布后的缺陷率。
• 该方法优于传统静态分析工具，因其聚焦于语义相似性和历史上下文，而非仅依赖语法规则。