BERT를 이용한 딥러닝 기반 소스코드 취약점 탐지 방법 연구
A BERT-Based Deep Learning Approach for Vulnerability Detection
0
조회
0
다운로드
2
인용
0
참고문헌
키워드
초록
SW 산업의 급속한 발전과 함께 새롭게 개발되는 코드와 비례해서 취약한 코드 또한 급증하고 있다. 기존에는 전문가가 수동으로 코드를 분석하여 취약점을 탐지하였지만 최근에는 증가하는 코드에 비해서 분석하는 인력이 부족하다. 이 때문에 기존 Vuldeepecker와 같은 많은 연구에서는 RNN 기반 모델을 이용하여 취약점을 탐지하였다. 그러나 RNN 모델은 코드의 양이 방대할수록 새롭게 입력되는 코드만 학습되고 초기에 입력된 코드는 최종 예측 결과에 영향을 주지 못하는 한계점이 있다. 또한 RNN 기반 방법은 입력에 Word2vec 모델을 사용하여 단어의 의미를 상징하는 embedding을 먼저 학습하여 고정 값으로 RNN 모델에 입력된다. 이는 서로 다른 문맥에서 다른 의미를 표현하지 못하는 한계점이 있다. BERT는 Transformer 모델을 기본 레이어로 사용하여 각 단어가 전체 문맥에서 모든 단어 간의 관계를 계산한다. 또한 MLM과 NST 방법으로 문장 간의 앞뒤 관계를 학습하기 때문에 취약점 탐지와 같은 코드 간 관계를 분석해야 할 필요가 있는 문제에서 적절한 방법이다. 본 논문에서는 BERT 모델과 결합하여 취약점 탐지하는 연구를 수행하였고 실험 결과 취약점 탐지의 정확성이 97.5%로 Vuldeepecker보다 정확성 1.5%. 효율성이 69%를 증가하였다.
Abstract
With the rapid development of SW Industry, softwares are everywhere in our daily life. The number of vulnerabilities are also increasing with a large amount of newly developed code. Vulnerabilities can be exploited by hackers, resulting the disclosure of privacy and threats to the safety of property and life. In particular, since the large numbers of increasing code, manually analyzed by expert is not enough anymore. Machine learning has shown high performance in object identification or classification task. Vulnerability detection is also suitable for machine learning, as a reuslt, many studies tried to use RNN-based model to detect vulnerability. However, the RNN model is also has limitation that as the code is longer, the earlier can not be learned well. In this paper, we proposed a novel method which applied BERT to detect vulnerability. The accuracy was 97.5%, which increased by 1.5%, and the efficiency also increased by 69% than Vuldeepecker.
참고문헌 (34)
- "CWEtop25 2021"[URL]
- Xiao, "An image-inspired and cnn-based android malware detection approach", Proceedings of the 34th IEEE, 2019, 1259~1261
- Li, Zhen, "Vuldeepecker: A deep learning-based system for vulnerability detection", Proceedings of the 25th Network and Distributed System Security (NDSS) Symposium, pp.1~15 (2018)
- Qiang, Gao, "Research on Software Vulnerability Detection Method Based on Improved CNN Model", Scientific Programming, 2022, pp.4442374~ (2022)
- Wu, Fang, "Vulnerability detection with deep learning", Proceedings of the 3rd IEEE International Conference on Computer and Communications (ICCC), pp.1298~1302 (2017)
- Russell, Rebecca, "Automated vulnerability detection in source code using deep representation learning", Proceedings of the 17th IEEE international conference on machine learning and applications (ICMLA), pp.757~762 (2018)
- Girshick Ross, "Fast r-cnn", Proceedings of the 2015 IEEE International Conference on Computer Vision, pp.1440~1448 (2015)
- Mikolov Tomas, "Recurrent neural network based language model", Jonornal of the Interspeech, 2(3), pp.1045~1048 (2010)
- Vaswani Ashish, "Attention is all you need", Proceedings of the 31st Conference on Neural Information Processing Systems (NIPS), 30, pp.1~11 (2017)
- "BERT"[URL]
- "CWE"[URL]
- "fotify"[URL]
- "Checkmarx"[URL]
- "AFL"[URL]
- Böhme Marcel, "Directed greybox fuzzing", Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pp.2329~2344 (2017)
- Gan Shuitao, "Collafl : Path sensitive fuzzing", Proceedings of the 2018 IEEE Symposium on Security and Privacy (SP), pp.679~696 (2018)
- Rawat Sanjay, "VUzzer : Application-aware Evolutionary Fuzzing", Proceedings of the Network and Distributed System Security (NDSS) Symposium, pp.1~14 (2016)
- Cha, Sang Kil, "Program-adaptive mutational fuzzing", Proceedings of the 2015 IEEE Symposium on Security and Privacy(S&P), pp.725~741 (2017)
- Ganesh, Vijay, "Taint-based directed whitebox fuzzing", Proceedings of the 2009 IEEE International Conference on Software Engineering(ICSE), pp.474~484 (2009)
- Chen, Peng, "Angora : Efficient fuzzing by principled search", Proceedings of the 2018 IEEE Symposium on Security and Privacy (SP), pp.711~725 (2015)
- Lin Guanjun, "Software vulnerability detection using deep neural networks: a survey", Proceedings of the IEEE, 108(10), pp.1825~1848 (2020)
- Fan, Ming, "Text backdoor detection using an interpretable rnn abstract model", Jonornal of the IEEE Transactions on Information Forensics and Security, 16(0), pp.4117~4132 (2021)
- Saccente, Nicholas, "Project achilles : A prototype tool for static method-level vulnerability detection of Java source code using a recurrent neural network", Proceedings of the 2019 IEEE, 2019, 114~121
- Grieco, Gustavo, "Toward large-scale vulnerability discovery using machine learning", Proceedings of the 6th ACM Conference on Data and Application Security and Privacy, pp.85~96 (2016)
- Wu, Fang, "Vulnerability detection with deep learning", Proceedings of the 3rd IEEE international conference on computer and communications (ICCC), pp.1298~1302 (2017)
- Zou, Deqing, "VulDeePecker : A Deep Learning-Based System for Multiclass Vulnerability Detection", IEEE Transactions on Dependable and Secure Computing, 18(5), pp.2224~2236 (2019)
- Shar, Lwin Khin, "Predicting SQL injection and cross site scripting vulnerabilities through mining input sanitization patterns", Information and Software Technology, 55(10), pp.1767~1780 (2013)
- Wang, Song, "Automatically learning semantic features for defect prediction", Proceedings of the 2016 IEEE, 2016, 297~308
- Lin, Guanjun, "POSTER : Vulnerability discovery with function representation learning fromunlabeled projects", Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pp.2539~2541 (2017)
- G. Lin, "Cross-project transfer representation learning for vulnerable function discovery", IEEE Transactions on Industrial Informatics, 14(7), pp.3289~3297 (2018)
- "Automatic feature learning for vulnerability prediction"[URL]
- Li, Zhen, "Sysevr: A framework for using deep learning to detect software vulnerabilities", IEEE Transactions on Dependable and Secure Computing, 19, pp.2244~2258 (2022)
- Weiser, Mark., "Program slicing", IEEE Transactions on Software Engineering, 4, pp.352~357 (1984)
- "joern"[URL]