DeeDP: vulnerability detection and patching based on deep learning

A Savchenko,O Sinelnikova,S Osadchyi,A Chernousov,O Fokin

doi:10.20535/tacs.2664-29132020.1.209465

Abstract

We present the DeeDP system for automatic vulnerabilities detection and patch providing. DeeDP allows to detect vulnerabilities in C/C++ source code and generate patch for fixing the detected issue. This system uses deep learning methods to organize rules for deciding whether a code fragment is vulnerable. Patch generation processes can be performed based on neural network and rule-based approaches. The system uses the abstract syntax tree (AST) representations of the source code fragments.We have tested effectiveness of our approach on different open source projects. For example, Microsoft/Terminal (https://github.com/microsoft/Terminal) was analyzed with DeeDP: our system detected security issue and generated patch which was successfully approved and applied by Microsoft maintainers.

Highlights

There are many cyber attacks which are rooted in software vulnerabilities
Prevention of software products compromising is related to application of different techniques e.g. Microsoft Security Development Lifecycle (SDL) and deep software analysis on early stages of development process
Is based on deep learning approach [1] for extraction of GenProg, AE and RSRepair use various search algovulnerable fragments of code represented as abstract syntax tree (AST) [2] rithms

Summary

Introduction

There are many cyber attacks which are rooted in software vulnerabilities. Prevention of software products compromising is related to application of different techniques e.g. Microsoft Security Development Lifecycle (SDL) and deep software analysis on early stages of development process. Patches are generated by applying fixed patterns that are written by a person based on the generalization of the rules to correct common vulnerabilities. Training neural network will be supervised, based on collected samples from existed open source repositories with detected weaknesses and after patch-fix from contributor.

Results

Conclusion