소스코드 취약성 분류를 위한 기계학습 기법의 적용
Application of Machine Learning Techniques for the Classification of Source Code Vulnerability
1
조회
0
다운로드
5
인용
0
참고문헌
키워드
초록
시큐어코딩은 악의적인 공격 혹은 예상치 못한 오류에 대한 강인함을 제공해줄 수 있는 안전한 코딩 기법으로 정적분석도구의 지원을 통해 취약한 패턴을 찾아내거나 오염 데이터의 유입 가능성을 발견한다. 시큐어코딩은 정적기법을 적극적으로 활용하는 만큼 룰셋에 의존적이라는 단점을 가지며, 정적분석 도구의 복잡성이 높아지는 만큼 정확한 진단이 어렵다는 문제점을 안고 있다. 본 논문은 시큐어코딩을 지원하는 목적으로 기계학습 기법 중 DNN과CNN, RNN 신경망을 이용하여 개발보안가이드 상의 주요 보안약점에 해당하는 패턴을 학습시키고 분류하는 모델을 개발하며 학습 결과를 분석한다. 이를 통해 기계학습 기법이 정적분석과 더불어 보안약점 탐지에 도움을 줄 수있을 것으로 기대한다.
Abstract
Secure coding is a technique that detects malicious attack or unexpected errors to make software systems resilient againstsuch circumstances. In many cases secure coding relies on static analysis tools to find vulnerable patterns and contaminateddata in advance. However, secure coding has the disadvantage of being dependent on rule-sets, and accurate diagnosis isdifficult as the complexity of static analysis tools increases. In order to support secure coding, we apply machine learningtechniques, such as DNN, CNN and RNN to investigate into finding major weakness patterns shown in secure developmentcoding guides and present machine learning models and experimental results. We believe that machine learning techniquescan support detecting security weakness along with static analysis techniques.
참고문헌 (17)
- X. Chen, "Multiview 3D object detection network for autonomous driving", 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp.6526~6534 (2017)
- J. Wang, "Deep learning for smart manufacturing: methods and applications", Journal of Manufacturing Systems, 48, pp.144~156 (2018)
- V. B. Livshits, "Finding security vulnerabilities in java applications with static analysis", Proceedings of the 14th conference on USENIX Security Symposium, 14, pp.18~18 (2005)
- Y. W. Huang, "Securing web application code by static analysis and runtime protection", Proceedings of the 13th international conference on World Wide Web, pp.40~52 (2004)
- A. M. Delaiter, "Sate v report: ten years of static analysis tool expositions" (2018)
- Development security guide for sw developers and operators of e-government, "Ministry of the Interior and Safety and Korea Internet & Security Agency", ~, pp.11-1311000-000330-10 (2017)
- V. Barstad, "Predicting source code quality with static analysis and machine learning", Norsk IKT-konferanse for forskning og utdanning, ~ (2015)
- R. Russell, "Automated vulnerability detection in source code using deep representation learning", 2018 17th IEEE International Conference on Machine Learning and Applications (ICMLA), pp.757~762 (2018), IEEE
- B. Kolosnjaji, "Deep learning for classification of malware system call sequences", Australasian Joint Conference on Artificial Intelligence, pp.137~149 (2016), Springer
- L. Zhen, "Vuldeepecker : a deep learning-based system for vulnerability detection", Proceedings 2018Network and Distributed System Security Symposium (2018)
- B. Chess, "Secure programming with static analysis" (2007), Pearson Education
- Y. Kim, "Convolutional neural networks for sentence classification", Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing (EMNL), pp.1746~1751 (2014)
- Vulnerability type distributions in cve, "S. Christey", Mitre, ~ (2007)
- J. Williams, "The ten most critical web application security risks, rc1", OWASP Foundation, ~ (2017)
- W.K. Lee, "A study on detection and classification of security vulnerabilities based on machine learning", MSc, pp.2018
- R. Nallapati, "Abstractive text summarization using sequence-to-sequence rnns and beyond", Proceedings of The 20th SIGNLL Conference on Computational Natural Language Learning, pp.280~290 (2016)
- Y. Tom, "Recent trends in deep learning based natural language processing", IEEE Computational Intelligence Magazine, 13(3), pp.55~75 (2018)