Flow Graph Research Articles

HGAT: smart contract vulnerability detection method based on hierarchical graph attention network

With the widespread use of blockchain, more and more smart contracts are being deployed, and their internal logic is getting more and more sophisticated. Due to the large false positive rate and low detection accuracy of most current detection methods, which heavily rely on already established detection criteria, certain smart contracts additionally call for human secondary detection, resulting in low detection efficiency. In this study, we propose HGAT, a hierarchical graph attention network-based detection model, in order to address the aforementioned issues as well as the shortcomings of current smart contract vulnerability detection approaches. First, using Syntax Tree (AST) and Control Flow Graph, the functions in the smart contract are abstracted into code graphs (CFG). Then abstract each node in the code subgraph, extract the node features, utilize the graph attention mechanism GAT, splice the obtained vectors to form the features of each line of statements and use these features to detect smart contracts. To create test data and assess HGAT, we leverage the open-source smart contract vulnerability sample dataset. The findings of the experiment indicate that this method can identify smart contract vulnerabilities more quickly and precisely than other detection techniques.

Semantic Clone Detection Based on Code Feature Fusion Learning

Code clones are duplicated code snippets that significantly threaten software maintenance and the public corpora of code representation learning. Traditionally, code context and its structure information abstract syntax tree (AST), control flow graph (CFG) are typical representations of source code, and context-based models and structure-based models contributed significantly to the development of code clone detection. In this paper, we present a hybrid embedding model for code clone detection (HEM-CCD), a fusion method of token sequential information and graph-based structure information. We insert tokens’ global context information encoded by a bi-directional recurrent neural network into the AST-based graph for comprehensive code semantic representation. Then, feeding the graph into a gated graph neural network we generate code semantic vectors for similarity evaluation. We have implemented our model on two public clone datasets (BigCloneBench and GoogleCodeJam), and the results indicate that HEM-CCD outperforms several state-of-the-art approaches.

TaintGuard: Preventing implicit privilege leakage in smart contract based on taint tracking at abstract syntax tree level

Solidity smart contracts play an important role in enabling interactions and collaborations among users in a decentralized blockchain-based community, and their security has received much attention in the industry. One of the most serious security issues faced by Solidity smart contracts is that the use of delegatecall to make cross-contract calls will tamper with contract privilege, which is difficult to detect. To improve the robustness of smart contract privilege control mechanisms at the level of source code, this paper designs and implements a new cross-contract static analysis tool called TaintGuard based on the abstract syntax tree of Solidity code and by combining taint analysis and instrumentation monitoring. TaintGuard uses solc to obtain the abstract syntax tree of the contract source code and then traverses the nodes of the tree to filter call relations that use delegatecall for cross-contract calls. Then, TaintGuard obtains the control flow graph within the target function, determines whether there are problematic paths in the control flow graph that may cause implicit leakage of contract privileges through static taint analysis, and instruments monitoring code in the corresponding position of the program. In this way, the contract status in the runtime stage is monitored to prevent the contract privileges from being tampered with by malicious callers. Finally, TaintGuard is evaluated against existing static analysis tools for Solidity smart contracts. The evaluation results indicate that TaintGuard outperforms other tools in terms of execution efficiency. Also, it can effectively fix the contract code with privilege leaks with a acceptable overhead.

Context Sensitivity without Contexts: A Cut-Shortcut Approach to Fast and Precise Pointer Analysis

Over the past decades, context sensitivity has been considered as one of the most effective ideas for improving the precision of pointer analysis for Java. Different from the extremely fast context-insensitivity approach, context sensitivity requires every program method to be analyzed under different contexts for separating the static abstractions of different dynamic instantiations of the method’s variables and heap objects, and thus reducing spurious object flows introduced by method calls. However, despite great precision benefits, as each method is equivalently cloned and analyzed under each context, context sensitivity brings heavy efficiency costs. Recently, numerous selective context-sensitive approaches have been put forth for scaling pointer analysis to large and complex Java programs by applying contexts only to the selected methods while analyzing the remaining ones context-insensitively; however, because the selective approaches do not fundamentally alter the primary methodology of context sensitivity (and do not thus remove its efficiency bottleneck), they produce much improved but still limited results. In this work, we present a fundamentally different approach called Cut-Shortcut for fast and precise pointer analysis for Java. Its insight is simple: the main effect of cloning methods under different contexts is to filter spurious object flows that have been merged inside a callee method; from the view of a typical pointer flow graph (PFG), such effect can be simulated by cutting off (Cut) the edges that introduce precision loss to certain pointers and adding Shortcut edges directly from source pointers to the target ones circumventing the method on PFG. As a result, we can achieve the effect of context sensitivity without contexts. We identify three general program patterns and develop algorithms based on them to safely cut off and add shortcut edges on PFG, formalize them and formally prove the soundness. To comprehensively validate Cut-Shortcut’s effectiveness, we implement two versions of Cut-Shortcut for two state-of-the-art pointer analysis frameworks for Java, one in Datalog for the declarative Doop and the other in Java for the imperative Tai-e, and we consider all the large and complex programs used in recent literatures that meet the experimental requirements. The evaluation results are extremely promising: Cut-Shortcut is even able to run faster than context insensitivity for most evaluated programs while obtaining high precision that is comparable to context sensitivity (if scalable) in both frameworks. This is for the first time that we have been able to achieve such a good efficiency and precision trade-off for those hard-to-analyze programs, and we hope Cut-Shortcut could offer new perspectives for developing more effective pointer analysis for Java in the future.

Java Code Clone Detection by Exploiting Semantic and Syntax Information From Intermediate Code-Based Graph

Code clone detection plays a critical role in the field of software engineering. To achieve this goal, developers are required to have rich development experience for finding the &#x201C;functional&#x201D; clone code. However, this is unfriendly to novice developers. Although many approaches were proposed to automatically detect code clones, the results are not satisfactory. A major reason is that it is difficult to extract syntax and semantic information from the source code. To resolve this problem, in this article, we develop a novel graph representation approach based on intermediate code to detect the functional code clones. This graph representation is built based on intermediate code compiled from the source code. By using it, we can easily utilize graph embedding techniques to extract syntactic and semantic features from abstract syntax tree, control flow graph, and DFG generated from intermediate code. After that, we use the Softmax classifier to detect functional code clone pairs. We evaluate the performance of the proposed graph representation approach based on intermediate code for the code clone detection task on the BigCloneBench dataset. In order to improve performance, the embedded representation of intermediate code is initialized based on pretrained vectors learned from the collected LLVM IR dataset in advance. The experimental results show that our proposed intermediate code-based graph approach performs better than existing functional code clone detection approaches. Especially for the type-4 code clone detection, our approach outperforms the baseline approaches by an average of 33.49&#x0025; in the term of <i>F</i>1 score.

SLocator: Localizing the Origin of SQL Queries in Database-Backed Web Applications

In database-backed web applications, developers often leverage Object-Relational Mapping (ORM) frameworks for database accesses. ORM frameworks provide an abstraction of the underlying database access details so that developers can focus on implementing the business logic of the application. However, due to the abstraction, developers may not know where and how a problematic SQL query is generated in the application code, causing challenges in debugging database access problems. In this paper, we propose an approach, called SLocator, which locates where a SQL query is generated in the application code. SLocator is a hybrid approach that leverages both static analysis and information retrieval (IR) techniques. SLocator uses static analysis to infer the database access for every possible path in the control flow graph. Then, given a SQL query, SLocator applies IR techniques to find the control flow path (i.e., a sequence of methods called in an interprocedural control flow graph) whose inferred database access has the highest similarity ranking. We implement SLocator for Java's official ORM API specification (JPA) and evaluate SLocator on seven open source Java applications. We find that SLocator is able to locate the control flow path that generates a SQL query with a Top@1 accuracy ranging from 37.4% to 70% for SQL queries in sessions, and 30.7% to 69.2% for individual SQL queries; and Top@5 ranging from 78.3% to 95.5% for SQL queries in sessions, and 59.1% to 100% for individual SQL queries. We also conduct a study to illustrate how SLocator may be used for locating issues in the database access code.

Learning and Fusing Multi-View Code Representations for Function Vulnerability Detection

The explosive growth of vulnerabilities poses a significant threat to the security of software systems. While various deep-learning-based vulnerability detection methods have emerged, they primarily rely on semantic features extracted from a single code representation structure, which limits their ability to detect vulnerabilities hidden deep within the code. To address this limitation, we propose S2FVD, short for Sequence and Structure Fusion-based Vulnerability Detector, which fuses vulnerability-indicative features learned from the multiple views of the code for more accurate vulnerability detection. Specifically, S2FVD employs either well-matched or carefully extended neural network models to extract vulnerability-indicative semantic features from the token sequence, attributed control flow graph (ACFG) and abstract syntax tree (AST) representations of a function, respectively. These features capture different perspectives of the code, which are then fused to enable S2FVD to accurately detect vulnerabilities that are well-hidden within a function. The experiments conducted on two large vulnerability datasets demonstrated the superior performance of S2FVD against state-of-the-art approaches, with its accuracy and F1 scores reaching 98.07% and 98.14% respectively in detecting the presence of vulnerabilities, and 97.93% and 97.94%, respectively, in pinpointing specific vulnerability types. Furthermore, with regard to the real-world dataset D2A, S2FVD achieved average performance gains of 6.86% and 14.84% in terms of accuracy and F1 metrics, respectively, over the state-of-the-art baselines. This ablation study also confirms the superiority of fusing the semantics implied in multiple distinct code views to further enhance vulnerability detection performance.

Stability Analysis of Phase Locked Loops for AC Microgrids With Hybrid Power Sources

Synchronous instability of the multiple distributed generations has been an important issue for microgrids. Therein, the phase locked loop (PLL) instability is one of the significant reason for synchronous instability of multi-inverter microgrids. Although this instability issue has been widely studied, it is ignored for microgrids with numerous inverters controlled through different controllers. To full this gap, this paper proposes a multi-inverter parallel microgrid stability analysis method based on PLL. Firstly, this paper establishes a PLL small signal model based on the droop control strategy and the P&Q control strategy. Furthermore, the whole PLL small signal analysis model of multi-inverter parallel microgrid is proposed by signal flow graph and Mason Gain Theorem, which is more convenient for power engineers. Eventually, the closed-loop transfer function of PLL is obtained. The proposed integrated small signal model can predict the synchronous stability regarding the PLL of the multi-inverter under grid-connected mode and the island mode. Finally, the simulation and experimental results can well validate the feasibility and effectiveness of the proposed stability analysis strategy based on PLL in the multi-inverter parallel microgrid. Therein, the simulation and experimental results illustrate that the proposed stability identification approach can provide an effective stability control parameter selection method.

Monitoring Software Execution Flow Through Power Consumption and Dynamic Time Warping

This work presents a technique for non-intrusive code execution tracking using side-channel signals of power consumption. Using a nearest-neighbor classifier that integrates the Dynamic Time Warping distance with information from the Control Flow Graph, it is possible to identify executed basic blocks from a trace of power consumption that exhibits temporal distortions due to assembly-level artifacts and varying operational conditions. Experimental results show that the proposed technique achieves over 95% precision when inferring the runtime execution flow of a cruise control application using unmarked traces of power consumption collected from different processors.

Applying Coding Behavior Features to Student Plagiarism Detection on Programming Assignments

In programming education, the result of plagiarism detection is a crucial criterion for assessing whether or not students can pass course exams. Recently, the prevalent methods for detecting student plagiarism have been proposed by analyzing source code. These methods extract features (such as token, abstract syntax tree and control flow graph) from the source code, examine the similarity of codes using various similarity detection methods, and then perform plagiarism detection based on a predefined plagiarism threshold. However, these previous methods for plagiarism detection have some problems. First, they are less effective in detecting code modification related to structure. Second, they require a considerable number of training data, which demand high computing time and space. Third, they cannot determine whether students plagiarize in time. We propose a novel plagiarism detection method by analyzing the behavioral features of students during the coding process. Specifically, we extract five behavioral features based on students’ programming habits. Then, we use a feature ranking-based suspiciousness algorithm to obtain the possibility of student plagiarism. Based on our proposed method, we develop the Online Integrated Programming Platform. To evaluate the accuracy of our method, we conduct a series of experiments. Final experimental results indicate that our method achieves promising results with Accuracy, Precision, Recall and [Formula: see text] values of 0.95, 0.90, 0.95 and 0.92, respectively. Finally, we also analyze the correlation between whether students plagiarized and their regular and final grades, which can further verify the effectiveness of our proposed method.

Plot extraction and the visualization of narrative flow

Abstract This article discusses the development of an automated plot extraction system for narrative texts. Acknowledging the distinction between plot, as an object of study with its own rich history and literature, and features of a text that may be automatically extractable, we begin by characterizing a text’s scatter plot of entities. This visualization of a text reveals entity density patterns characterizing the particular telling of the story under investigation and leads to effective scene partitioning. We then introduce the concept of narrative flow, a graph representation of the narrative ordering of scenes (the syuzhet) that includes how entities move through scenes from the text, and investigate the degree to which narrative flow can be automatically extracted given a glossary of plot-important objects, actors, and locations. Our subsequent analysis then explores the correlation between subjective notions of plot and the information extracted through these visualizations. In particular, we discuss narrative structures commonly found within the graphs and make comparisons with ground truth narrative flow graphs, showing mixed results highlighting the difficulty of plot extraction. However, the visual artifacts and common structural relationships seen in the graphs provide insight into narrative and its underlying plot.

Breaking the structure of MaMaDroid

Android malware is a continuously expanding threat to billions of mobile users around the globe. Detection systems are updated constantly to address these threats. However, a backlash takes the form of evasion attacks, in which an adversary changes malicious samples in the wild such that they will be misclassified as benign. This paper comprehensively inspects a well-known Android malware detection system, MaMaDroid, which analyzes the control flow graph of the application. Changes in the portion of benign samples in the training set are considered to reveal their effect on the resulting classifier. These changes in the ratio between benign and malicious samples have a clear effect on each of the models, resulting in a decrease of more than 40% in their detection rate, model confidence, and reliability. Moreover, adopted Machine Learning models were implemented as well, including 5-NN, Decision Tree, and Adaboost. Exploration of the six models showed a typical behavior in different cases, of tree-based models and distance-based models. Moreover, three novel attacks that manipulate the Control Flow Graph (CFG) are described for each of the targeted models. The attacks decrease the detection rate of most models to less than 10%, with regards to different ratios of benign to malicious apps. As a result, a new version of MaMaDroid is engineered, which fuses the CFG of the app and static analysis of features of the app. This improved model is proven to be robust against evasion attacks targeting CFG-based models and static analysis models, achieving a detection rate of ∼80%.

Dynamical Bifurcation for a Class of Large-Scale Fractional Delayed Neural Networks With Complex Ring-Hub Structure and Hybrid Coupling.

Real neural networks are characterized by large-scale and complex topology. However, the current dynamical analysis is limited to low-dimensional models with simplified topology. Therefore, there is still a huge gap between neural network theory and its application. This article proposes a class of large-scale neural networks with a ring-hub structure, where a hub node is connected to n peripheral nodes and these peripheral nodes are linked by a ring. In particular, there exists a hybrid coupling mode in the network topology. The mathematical model of such systems is described by fractional-order delayed differential equations. The aim of this article is to investigate the local stability and Hopf bifurcation of this high-dimensional neural network. First, the Coates flow graph is employed to obtain the characteristic equation of the linearized high-dimensional neural network model, which is a transcendental equation including multiple exponential items. Then, the sufficient conditions ensuring the stability of equilibrium and the existence of Hopf bifurcation are achieved by taking time delay as a bifurcation parameter. Finally, some numerical examples are given to support the theoretical results. It is revealed that the increasing time delay can effectively induce the occurrence of periodic oscillation. Moreover, the fractional order, the self-feedback coefficient, and the number of neurons also have effects on the onset of Hopf bifurcation.

Storage State Analysis and Extraction of Ethereum Blockchain Smart Contracts

In migrating and upgrading an Ethereum smart contract, it is necessary to transfer both the code as well as the stored data. Various methods attempt to migrate or upgrade a smart contract, but they are mostly manual, error-prone, and applicable only before deployment. Further, they have challenges in extracting the storage state of complex mapping data structures along with their keys. In this work, we present Smartmuv as an automatic source-code-based static analysis tool to analyze and extract the state from the storage-trie of smart contracts. Based on the abstract syntax tree and the control flow graphs of the Solidity source code, the tool analyzes each state variable including mapping types along the inheritance hierarchy. It also provides the upgrade algorithm that initializes the extracted state in the constructor of new smart contract. Smartmuv safely approximates the origin of the keys used in the mapping to extract values and has been able to extract the mapping state of 23,673 smart contracts with 95.7% overall precision. Moreover, we also validate the Smartmuv’s extracted state with the third-party tool Etherscan.

A UML Activity Flow Graph-Based Regression Testing Approach

Regression testing is a crucial process that ensures that changes made to a system do not affect existing functionalities. However, there is currently no adequate technique for selecting test cases that consider changes in Unified Modeling Language (UML) activity flow graphs. This paper proposes a novel approach to regression testing of UML diagrams, focusing on healthcare management systems. We provide a formal definition of sequence and activity diagrams and their relationship and construct corresponding activity flow graphs, which are used to develop a regression testing algorithm. The proposed algorithm categorizes test cases into reusable, retestable, obsolete, and newly generated categories by comparing old and new versions of UML activity flow graphs. The methodology is evaluated using a custom-designed hospital management system website as the test case, and the results demonstrate a significant reduction in time and resources required for regression testing. Our study provides valuable insights into the application of UML diagrams and activity flow graphs in regression testing, making it an important contribution to software testing research.

BejaGNN: behavior-based Java malware detection via graph neural network.

As a popular platform-independent language, Java is widely used in enterprise applications. In the past few years, language vulnerabilities exploited by Java malware have become increasingly prevalent, which cause threats for multi-platform. Security researchers continuously propose various approaches for fighting against Java malware programs. The low code path coverage and poor execution efficiency of dynamic analysis limit the large-scale application of dynamic Java malware detection methods. Therefore, researchers turn to extracting abundant static features to implement efficient malware detection. In this paper, we explore the direction of capturing malware semantic information by using graph learning algorithms and present BejaGNN (Behavior-based Java malware detection via Graph Neural Network), a novel behavior-based Java malware detection method using static analysis, word embedding technique, and graph neural network. Specifically, BejaGNN leverages static analysis techniques to extract ICFGs (Inter-procedural Control Flow Graph) from Java program files and then prunes these ICFGs to remove noisy instructions. Then, word embedding techniques are adopted to learn semantic representations for Java bytecode instructions. Finally, BejaGNN builds a graph neural network classifier to determine the maliciousness of Java programs. Experimental results on a public Java bytecode benchmark demonstrate that BejaGNN achieves high F1 98.8% and is superior to existing Java malware detection approaches, which verifies the promise of graph neural network in Java malware detection.

A Hypothesis Testing-Based Framework for Software Cross-Modal Retrieval in Heterogeneous Semantic Spaces

Software cross-modal retrieval is a popular yet challenging direction, such as bug localization and code search. Previous studies generally map natural language texts and codes into a homogeneous semantic space for similarity measurement. However, it is not easy to accurately capture their similar semantics in a homogeneous semantic space due to the semantic gap. Therefore, we propose to map the multi-modal data into heterogeneous semantic spaces to capture their unique semantics. Specifically, we propose a novel software cross-modal retrieval framework named Deep Hypothesis Testing (DeepHT). In DeepHT, to capture the unique semantics of the code’s control flow structure, all control flow paths (CFPs) in the control flow graph are mapped to a CFP sample set in the sample space. Meanwhile, the text is mapped to a CFP correlation distribution in the distribution space to model its correlation with different CFPs. The matching score is calculated according to how well the sample set obeys the distribution using hypothesis testing. The experimental results on two text-to-code retrieval tasks (i.e., bug localization and code search) and two code-to-text retrieval tasks (i.e., vulnerability knowledge retrieval and historical patch retrieval) show that DeepHT outperforms the baseline methods.

Codeformer: A GNN-Nested Transformer Model for Binary Code Similarity Detection

Binary code similarity detection is used to calculate the code similarity of a pair of binary functions or files, through a certain calculation method and judgment method. It is a fundamental task in the field of computer binary security. Traditional methods of similarity detection usually use graph matching algorithms, but these methods have poor performance and unsatisfactory effects. Recently, graph neural networks have become an effective method for analyzing graph embeddings in natural language processing. Although these methods are effective, the existing methods still do not sufficiently learn the information of the binary code. To solve this problem, we propose Codeformer, an iterative model of a graph neural network (GNN)-nested Transformer. The model uses a Transformer to obtain an embedding vector of the basic block and uses the GNN to update the embedding vector of each basic block of the control flow graph (CFG). Codeformer iteratively executes basic block embedding to learn abundant global information and finally uses the GNN to aggregate all the basic blocks of a function. We conducted experiments on the OpenSSL, Clamav and Curl datasets. The evaluation results show that our method outperforms the state-of-the-art models.

Efficient and linear static approach for finding the memory leak in C

Code analysis has discovered that memory leaks are common in the C programming language. In the literature, there exist various approaches for statically analyzing and detecting memory leaks. The complexity and diversity of memory leaks make it difficult to find an approach that is both effective and simple. In embedded systems, costly resources like memory become limited as the system’s size diminishes. As a result, memory must be handled effectively and efficiently too. To obtain precise analysis, we propose a novel approach that works in a phase-wise manner. Instead of examining all possible paths for finding memory leaks, we use a program slicing to check for a potential memory leak. We introduce a source-sink flow graph (SSFG) based on source-sink properties of memory allocation-deallocation within the C code. To achieve simplicity in analysis, we also reduce the complexity of analysis in linear time. In addition, we utilize a constraint solver to improve the effectiveness of our approach. To evaluate the approach, we perform manual scanning on various test cases: link list applications, Juliet test cases, and common vulnerabilities and exposures found in 2021. The results show the efficiency of the proposed approach by preparing the SSFG with linear complexity.

DeGraphCS : Embedding Variable-based Flow Graph for Neural Code Search

With the rapid increase of public code repositories, developers maintain a great desire to retrieve precise code snippets by using natural language. Despite existing deep learning-based approaches that provide end-to-end solutions (i.e., accept natural language as queries and show related code fragments), the performance of code search in the large-scale repositories is still low in accuracy because of the code representation (e.g., AST) and modeling (e.g., directly fusing features in the attention stage). In this paper, we propose a novel learnable de ep G raph for C ode S earch (called deGraphCS ) to transfer source code into variable-based flow graphs based on an intermediate representation technique, which can model code semantics more precisely than directly processing the code as text or using the syntax tree representation. Furthermore, we propose a graph optimization mechanism to refine the code representation and apply an improved gated graph neural network to model variable-based flow graphs. To evaluate the effectiveness of deGraphCS , we collect a large-scale dataset from GitHub containing 41,152 code snippets written in the C language and reproduce several typical deep code search methods for comparison. The experimental results show that deGraphCS can achieve state-of-the-art performance and accurately retrieve code snippets satisfying the needs of the users.