VulDeePecker: A Deep Learning-Based System for Vulnerability Detection

Abstract

Abstract-The automatic detection of software vulnerabilities is an important research problem. However, existing solutions to this problem rely on human experts to define features and often miss many vulnerabilities (i.e., incurring high false negative rate). In this paper, we initiate the study of using deep learning-based vulnerability detection to relieve human experts from the tedious and subjective task of manually defining features. Since deep learning is motivated to deal with problems that are very different from the problem of vulnerability detection, we need some guiding principles for applying deep learning to vulnerability detection. In particular, we need to find representations of software programs that are suitable for deep learning. For this purpose, we propose using code gadgets to represent programs and then transform them into vectors, where a code gadget is a number of (not necessarily consecutive) lines of code that are semantically related to each other. This leads to the design and implementation of a deep learning-based vulnerability detection system, called Vulnerability Deep Pecker (VulDeePecker). In order to evaluate VulDeePecker, we present the first vulnerability dataset for deep learning approaches. Experimental results show that VulDeePecker can achieve much fewer false negatives (with reasonable false positives) than other approaches. We further apply VulDeePecker to 3 software products (namely Xen, Seamonkey, and Libav) and detect 4 vulnerabilities, which are not reported in the National Vulnerability Database but were "silently" patched by the vendors when releasing later versions of these products; in contrast, these vulnerabilities are almost entirely missed by the other vulnerability detection systems we experimented with.

μVulDeePecker: A Deep Learning-Based System for Multiclass Vulnerability Detection

“…First, a conceptual innovation underlying µVulDeePecker is the introduction of the concept we call code attention, which can accommodate information useful for learning local features and helping pinpoint types of vulnerabilities. It refines the concept of code gadget [13] which is a number of statements that are semantically related to each other. Second, another innovation underlying µVulDeePecker is redefining arXiv:2001.02334v1 [cs.CR] 8 Jan 2020 the concept and extraction method of code gadget by introducing control-dependence.…”

“…We name our multiclass vulnerability detection system, namely µVulDeePecker, after the system known as VulDeePecker [13], which is the first deep learning-based binary vulnerability detection system (i.e., only able to tell whether a piece of code is vulnerable or not, but not the type of a vulnerability in question). The reason we are so named is that our system is inspired by VulDeePecker; indeed, we refine the concept of code gadget introduced in [13], which only captures data dependence, by additionally accommodating control dependence, which leads to higher effectiveness in multiclass vulnerability detection. However, we stress that µVulDeePecker is not a simple incremental work over VulDeePecker [13].…”

A performance evaluation of deep‐learnt features for software vulnerability detection

“…The computational system is a server running CentOS Linux 7 with two Physical Intel(R) Xeon(R) E5‐2690 v3 2.60GHz CPUs and 96GB RAM. For code gadgets, we use the same parameter setting as Li et al…”

“…The first layer is an embedding layer which maps each element of the sequence to a dense vector of fixed dimensionality. In conducting a comparative study, we adopt the datasets published by Li et al 35 We download 2 additional datasets and obtain the code gadgets as feature presentations according to what is described in the paper, where CWE119 contains buffer errors and CWE399 contains management errors.…”

“…The computational system is a server running CentOS Linux 7 with two Physical Intel(R) Xeon(R) E5-2690 v3 2.60GHz CPUs and 96GB RAM. For code gadgets, we use the same parameter setting as Li et al 35 For the performane experiments, we employ six machine learning algorithms, which are C4.5 decision tree (J48), k-nearest neighbour(KNN), LDA, neural network(NN), random forest, and SVM. We use default setting in weka, and perform 10 runs of 10-fold cross-validation on each dataset.…”