Deep Cost-Sensitive Kernel Machine for Binary Software Vulnerability Detection

Nguyen, Tuan Dung; Le, Trung; Nguyen, Khanh; Vel, Olivier Y. de; Montague, Paul; Grundy, John; Phung, Dinh

doi:10.1007/978-3-030-47436-2_13

Cited by 5 publications

(2 citation statements)

References 15 publications

(19 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The meta‐features of binaries such as the opcode, number of instructions, and number of basic blocks can be represented using a numeric representation, which can be embedded into a feature space for ML 56 . By nature, datasets for binary vulnerability detection are typically imbalanced 57 . This allows for implementing ML strategies such as imbalance handling on binary datasets, which can further enhance the vulnerability detection scores.…”

Section: Discussionmentioning

confidence: 99%

See 1 more Smart Citation

An empirical evaluation of deep learning‐based source code vulnerability detection: Representation versus models

Semasaba

Zheng

et al. 2022

J Software Evolu Process

View full text Add to dashboard Cite

Vulnerabilities in the source code of the software are critical issues in the realm of software engineering. Coping with vulnerabilities in software source code is becoming more challenging due to several aspects such as complexity and volume. Deep learning has gained popularity throughout the years as a means of addressing such issues. This paper proposes an evaluation of vulnerability detection performance on source code representations and evaluates how machine learning (ML) strategies can improve them. The structure of our experiment consists of three deep neural networks (DNNs) in conjunction with five different source code representations: abstract syntax trees (ASTs), code gadgets (CGs), semantics‐based vulnerability candidates (SeVCs), lexed code representations (LCRs), and composite code representations (CCRs). Experimental results show that employing different ML strategies in conjunction with the base model structure influences the performance results to a varying degree. However, ML‐based techniques suffer from poor performance on class imbalance handling and dimensionality reduction when used in conjunction with source code representations.

show abstract

Section: Discussionmentioning

confidence: 99%

“…56 By nature, datasets for binary vulnerability detection are typically imbalanced. 57 This allows for implementing ML strategies such as imbalance handling on binary datasets, which can further enhance the vulnerability detection scores.…”

Section: Binary Code Analysismentioning

confidence: 99%

An empirical evaluation of deep learning‐based source code vulnerability detection: Representation versus models

Semasaba

Zheng

et al. 2022

J Software Evolu Process

View full text Add to dashboard Cite

show abstract

Code Action Network for Binary Function Scope Identification

Nguyen

Le³

et al. 2020

Advances in Knowledge Discovery and Data Mining

Self Cite

View full text Add to dashboard Cite

Function identification is a preliminary step in binary analysis for many applications from malware detection, common vulnerability detection and binary instrumentation to name a few. In this paper, we propose the Code Action Network (CAN) whose key idea is to encode the task of function scope identification to a sequence of three action states NI (i.e., next inclusion), NE (i.e., next exclusion), and FE (i.e., function end) to efficiently and effectively tackle function scope identification, the hardest and most crucial task in function identification. A bidirectional Recurrent Neural Network is trained to match binary programs with their sequence of action states. To work out function scopes in a binary, this binary is first fed to a trained CAN to output its sequence of action states which can be further decoded to know the function scopes in the binary. We undertake extensive experiments to compare our proposed method with other state-of-the-art baselines. Experimental results demonstrate that our proposed method outperforms the state-of-the-art baselines in terms of predictive performance on real-world datasets which include binaries from well-known libraries.

show abstract

Automating shareable cyber threat intelligence production for closed source software vulnerabilities: a deep learning based detection system

Arıkan,

Koçak,

Alkan

2024

Int. J. Inf. Secur.

View full text Add to dashboard Cite

Software can be vulnerable to various types of interference. The production of cyber threat intelligence for closed source software requires significant effort, experience, and many manual steps. The objective of this study is to automate the process of producing cyber threat intelligence, focusing on closed source software vulnerabilities. To achieve our goal, we have developed a system called cti-for-css. Deep learning algorithms were used for detection. To simplify data representation and reduce pre-processing workload, the study proposes the function-as-sentence approach. The MLP, OneDNN, LSTM, and Bi-LSTM algorithms were trained using this approach with the SOSP and NDSS18 binary datasets, and their results were compared. The aforementioned datasets contain buffer error vulnerabilities (CWE-119) and resource management error vulnerabilities (CWE-399). Our results are as successful as the studies in the literature. The system achieved the best performance using Bi-LSTM, with F1 score of 82.4%. Additionally, AUC score of 93.0% was acquired, which is the best in the literature. The study concluded by producing cyber threat intelligence using closed source software. Shareable intelligence was produced in an average of 0.1 s, excluding the detection process. Each record, which was represented using our approach, was classified in under 0.32 s on average.

show abstract

Deep Cost-Sensitive Kernel Machine for Binary Software Vulnerability Detection

Cited by 5 publications

References 15 publications

An empirical evaluation of deep learning‐based source code vulnerability detection: Representation versus models

An empirical evaluation of deep learning‐based source code vulnerability detection: Representation versus models

Code Action Network for Binary Function Scope Identification

Automating shareable cyber threat intelligence production for closed source software vulnerabilities: a deep learning based detection system

Contact Info

Product

Resources

About