기계학습 알고리즘을 이용한 소프트웨어 취약 여부 예측 시스템
Software Vulnerability Prediction System Using Machine Learning Algorithm
1
조회
0
다운로드
2
인용
0
참고문헌
키워드
초록
4차 산업혁명 시대에 우리는 소프트웨어 홍수 속에 살고 있다. 그러나, 소프트웨어의 증가는 필연적으로 소프트웨어 취약점 증가로 이어지고 있어 소프트웨어 취약점을 탐지 및 제거하는 작업이 중요하게 되었다. 현재까지 소프트웨어 취약 여부를 예측하는 연구가 진행되었지만, 탐지 시간이 오래 걸리거나, 예측 정확도가 높지 않았다. 따라서본 논문에서는 기계학습 알고리즘을 이용하여 소프트웨어의 취약 여부를 효율적으로 예측하는 방법을 설명하며, 다양한 기계학습 알고리즘을 이용한 실험 결과를 비교한다. 실험 결과 k-Nearest Neighbors 예측 모델이 가장 높은 예측률을 보였다.
Abstract
In the Era of the Fourth Industrial Revolution, we live in huge amounts of software. However, as software increases,software vulnerabilities are also increasing. Therefore, it is important to detect and remove software vulnerabilities. Currently,many researches have been studied to predict and detect software security problems, but it takes a long time to detect anddoes not have high prediction accuracy. Therefore, in this paper, we describe a method for efficiently predicting softwarevulnerabilities using machine learning algorithms. In addition, various machine learning algorithms are compared throughexperiments. Experimental results show that the k-nearest neighbors prediction model has the highest prediction rate.
참고문헌 (21)
- S. Neuhaus, "Predicting vulnerable software components", Proceedings of the 14th ACM conference on Computer and communications security, pp.529~540 (2007)
- Cagatay Catal, "A systematic review of software fault prediction studies", Expert Systems with Applications, 36(4), pp.7346~7354 (2009), Elsevier BV[DOI]
- Sangsu Kim, "Software Vulnerability Analysis using File Fuzzing", Conference of The Korean Society Of Computer And Information, 25(2), pp.29~32 (2017)
- James C. King, "Symbolic execution and program testing", Communications of the ACM, 19(7), pp.385~394 (1976), Association for Computing Machinery (ACM)[DOI]
- Sunnyeo Park, "Automated Vulnerability Analysis Tool for Binary Codes based on Symbolic Execution", Journal of Scientific Conference of Korean Institute of Information Scientists and Engineers, pp.1917~1919 (2017)
- Barton P. Miller, "An empirical study of the reliability of UNIX utilities", Communications of the ACM, 33(12), pp.32~44 (1990), Association for Computing Machinery (ACM)[DOI]
- 신민식, "스마트폰 미디어 서버 데몬에 대한 파일 포맷 인식 기반의 퍼징 연구", 정보보호학회논문지, 27(3), pp.541~548 (2017), 한국정보보호학회[DOI]
- 조제경, "안드로이드 기반 문서 어플리케이션의 퍼징 방법론 연구", 정보보호학회논문지, 25(1), pp.31~37 (2015), 한국정보보호학회[DOI]
- Nguyen, Viet Hung, "Predicting vulnerable software components with dependency graphs", Proceedings of the 6th International Workshop on Security Measurements and Metrics, pp.1~8 (2010)
- Yonghee Shin, "An empirical model to predict security vulnerabilities using code complexity metrics", Proceedings of the Second ACM-IEEE international symposium on Empirical software engineering and measurement, pp.315~317 (2008)
- Yonghee Shin, "Is complexity really the enemy of software security?", Proceedings of the 4th ACM workshop on Quality of protection, pp.47~50 (2008)
- Young Jun Lee, "Learning binary code with deep learning to detect software weakness", KSII The 9th International Conference on Internet 2017 Symposium, pp.245~249 (2017)
- Grieco, G, "Toward large-scale vulnerability discovery using Machine Learning", Proceedings of the Sixth ACM Conference on Data and Application Security and Privacy, pp.85~96 (2016)
- "python-ptrace"[URL]
- "zzuf-multi-purposefuzzer"[URL]
- Witten, I.H., "Data Mining: Practical machine learning tools and techniques" (2016), Morgan Kaufmann
- Muller, Andreas C., "Introduction to machine learning with Python: a guide for data scientists" (2016), O'Reilly Media, Inc
- Pedregosa, Fabian, "Scikitlearn: machine learning in python", Journal of Machine Learning Research, pp.2825~2830 (2011)
- Domingos, Pedro, "A few useful things to know about machine learning", Communications of the ACM, 55(10), pp.78~87 (2012)
- Hsu, Chih-Wei, "A practical guide to support vector classification" (2003), Department of Computer Science, National Taiwan University
- Gustavo E. A. P. A. Batista, "A study of the behavior of several methods for balancing machine learning training data", ACM SIGKDD Explorations Newsletter, 6(1), pp.20~ (2004), Association for Computing Machinery (ACM)[DOI]