Vulnerability Detection Methods Research Articles

Vulnerability extraction and prediction method based on improved information gain algorithm.

More and more attention has been paid to computer security, and its vulnerabilities urgently need more sensitive solutions. Due to the incomplete data of most vulnerability libraries, it is difficult to obtain pre-permission and post-permission of vulnerabilities, and construct vulnerability exploitation chains, so it cannot to respond to vulnerabilities in time. Therefore, a vulnerability extraction and prediction method based on improved information gain algorithm is proposed. Considering the accuracy and response speed of deep neural network, deep neural network is adopted as the basic framework. The Dropout method effectively reduces overfitting in the case of incomplete data, thus improving the ability to extract and predict vulnerabilities. These experiments confirmed that the excellent F1 and Recall of the improved method reached 0.972 and 0.968, respectively. Compared to the function fingerprints vulnerability detection method and K-nearest neighbor algorithm, the convergence is better. Its response time is 0.12 seconds, which is excellent. To ensure the reliability and validity of the proposed method in the face of missing data, the reliability and validity of Mask test are verified. The false negative rate was 0.3% and the false positive rate was 0.6%. The prediction accuracy of this method for existing permissions reached 97.9%, and it can adapt to the development of permissions more actively, so as to deal with practical challenges. In this way, companies can detect and discover vulnerabilities earlier. In security repair, this method can effectively improve the repair speed and reduce the response time. The prediction accuracy of post-existence permission reaches 96.8%, indicating that this method can significantly improve the speed and efficiency of vulnerability response, and strengthen the understanding and construction of vulnerability exploitation chain. The prediction of the posterior permission can reduce the attack surface of the vulnerability, thus reducing the risk of breach, speeding up the detection of the vulnerability, and ensuring the timely implementation of security measures. This model can be applied to public network security and application security scenarios in the field of computer security, as well as personal computer security and enterprise cloud server security. In addition, the model can also be used to analyze attack paths and security gaps after security accidents. However, the prediction of post-permissions is susceptible to dynamic environments and relies heavily on the updated guidance of security policy rules. This method can improve the accuracy of vulnerability extraction and prediction, quickly identify and respond to security vulnerabilities, shorten the window period of vulnerability exploitation, effectively reduce security risks, and improve the overall network security defense capability. Through the application of this model, the occurrence frequency of security vulnerability time is reduced effectively, and the repair time of vulnerability is shortened.

Vulnerabilities and Security Patches Detection in OSS: A Survey

Over the past decade, Open Source Software (OSS) has experienced rapid growth and widespread adoption, attributed to its openness and editability. However, this expansion has also brought significant security challenges, particularly introducing and propagating software vulnerabilities. Despite the use of machine learning and formal methods to tackle these issues, there remains a notable gap in comprehensive surveys that summarize and analyze both vulnerability detection (VD) and security patch detection (SPD) in OSS. This article seeks to bridge this gap through an extensive survey that evaluates 127 technical studies published between 2014 and 2023, structured around the Vulnerability-Patch life cycle. We begin by delineating the six critical events that constitute the Vulnerability-Patch life cycle, leading to an in-depth exploration of the Vulnerability-Patch Ecosystem. We then systematically review the databases commonly used in VD and SPD, and analyze their characteristics. Subsequently, we examine existing VD methods, focusing on traditional and deep learning-based approaches. Additionally, we organize current security patch identification methods by kernel type and discuss techniques for detecting the presence of security patches. Based on our comprehensive review, we identify open research questions and propose future research directions that merit further exploration.

Securing Container Images through Automated Vulnerability Detection in Shift-Left CI/CD Pipelines

Integrating shift-left security practices and automated vulnerability detection in container images is imperative for modern software development, given the dynamics and vulnerability landscape. This crucial methodology emphasizes security from the initial stages of integration in container-based environments like Docker and Kubernetes. The paper examines containerization security challenges, including image vulnerabilities, insecure configurations, runtime risks, weak orchestration security, and supply chain weaknesses, while stressing compliance with regulatory rules. It explores how this automated approach leverages vulnerability detection methods integrated into Continuous Integration/Continuous Deployment (CI/CD) pipelines through static and dynamic analyses, vulnerability databases, and policy-enforcement mechanisms. Beyond identifying vulnerabilities in CI/CD pipelines, the paper outlines methods to avoid policy violations, mitigate vulnerable images, and prevent recurring practices. Importantly, it underscores the continuous enforcement and remediation of policies and security standards. Security teams must invest efforts in developing policies, automated executions, and remediation procedures, fostering cross-departmental collaboration. In essence, this proactive stance aims to enhance software security, reduce risks, and improve adherence in containerized ecosystems, making it an indispensable component of modern software development.

A vulnerability detection framework by focusing on critical execution paths

Context:Vulnerability detection is critical to ensure software security, and detecting vulnerabilities in smart contract code is currently gaining massive attention. Existing deep learning-based vulnerability detection methods represent the code as a code structure graph and eliminate vulnerability-irrelevant nodes. Then, they learn vulnerability-related code features from the simplified graph for vulnerability detection. However, this simplified graph struggles to represent relatively complete structural information of code, which may affect the performance of existing vulnerability detection methods. Objective:In this paper, we present a novel Vulnerability Detection framework based on Critical Execution Paths (VDCEP), which aims to improve smart contract vulnerability detection. Method:Firstly, given a code structure graph, we deconstruct it into multiple execution paths that reflect rich structural information of code. To reduce irrelevant code information, a path selection strategy is employed to identify critical execution paths that may contain vulnerable code information. Secondly, a feature extraction module is adopted to learn feature representations of critical paths. Finally, we feed all path feature representations into a classifier for vulnerability detection. Also, the feature weights of paths are provided to measure their importance in vulnerability detection. Results:We evaluate VDCEP on a large dataset with four types of smart contract vulnerabilities. Results show that VDCEP outperforms 14 representative vulnerability detection methods by 5.34%–60.88% in F1-score. The ablation studies analyze the effects of our path selection strategy and feature extraction module on VDCEP. Moreover, VDCEP still outperforms ChatGPT by 34.46% in F1-score. Conclusion:Compared to existing vulnerability detection methods, VDCEP is more effective in detecting smart contract vulnerabilities by utilizing critical execution paths. Besides, we can provide interpretable details about vulnerability detection by analyzing the path feature weights.

A vulnerability detection framework with enhanced graph feature learning

Vulnerability detection in smart contracts is critical to secure blockchain systems. Existing methods represent the bytecode as a graph structure and leverage graph neural networks to learn graph features for vulnerability detection. However, these methods are limited to handling the long-range dependencies between nodes. This means that they might focus on learning local node feature while ignoring global node information. In this paper, we propose a novel vulnerability detection framework with Enhanced Graph Feature Learning (EGFL), which aims to extract the global node information and utilize it to improve vulnerability detection in smart contracts. Specifically, we first represent the bytecode as a Control Flow Graph (CFG). To extract global node information, EGFL constructs a linear node feature matrix from CFG, and uses the feature-aware and relationship-aware modules to handle long-range dependencies between nodes. Meanwhile, a graph neural network is adopted to extract the local node feature from CFG. Subsequently, we fuse the global node information and local node feature to generate an enhanced graph feature for capturing more vulnerability features. We evaluate EGFL on the benchmark dataset with six types of smart contract vulnerabilities. Results show that EGFL outperforms fourteen state-of-the-art vulnerability detection methods by 10.83%–60.28% in F1 score.

A vulnerability detection method for IoT protocol based on parallel fuzzy algorithm

The Internet of Things communication protocol is prone to security vulnerabilities when facing increasing types and scales of network attacks, which can affect the communication security of the Internet of Things. It is crucial to effectively detect these vulnerabilities in order to improve the security of IoT communication protocols and promptly fix them. Therefore, this study proposes a distributed IoT communication protocol vulnerability detection method based on an improved parallelized fuzzy testing algorithm. Firstly, based on design principles and by comparing different communication protocols, a communication architecture for the distribution network's Internet of Things was constructed, and the communication protocols were formalized and decomposed. Next, preprocess the vulnerability detection samples, and then use genetic algorithm to improve the parallelized fuzzy testing algorithm to perform vulnerability detection. Through this improved algorithm, the missed detection rate and false detection rate can be effectively reduced, thereby improving the security of IoT communication protocols. The experimental results show that the highest missed detection rate of this method is only 4.0 %, and the false detection rate is low, with high detection efficiency. This indicates that the method has good performance and reliability in detecting vulnerabilities in IoT communication protocols.

Reentrancy vulnerability detection based on graph convolutional networks and expert patterns under subspace mapping

Smart contracts with automatic execution capability provide a vast development space for transactions in Blockchain. However, due to the vulnerabilities in smart contracts, Blockchain has suffered huge economic losses, which greatly undermines people’s trust in Blockchain and smart contracts. In this paper, we explore a vulnerability detection method based on graph neural networks and combine both contract source code and opcode. The structure of the method consists of four modules, i.e., preprocessing, subspace mapping, feature extraction, and detection modules. In the feature mapping module, we use a multi-subspace mapping approach to explore the impact of different subspace mappings on the detection method. For reentrancy vulnerability, we conducted extensive experiments. The experiments prove that our method achieves 95% accuracy and 94% F1-Score on average.

VulMPFF: A Vulnerability Detection Method for Fusing Code Features in Multiple Perspectives

Source code vulnerabilities are one of the significant threats to software security. Existing deep learning-based detection methods have proven their effectiveness. However, most of them extract code information on a single intermediate representation of code (IRC), which often fails to extract multiple information hidden in the code fully, significantly limiting their performance. To address this problem, we propose VulMPFF, a vulnerability detection method that fuses code features under multiple perspectives. It extracts IRC from three perspectives: code sequence, lexical and syntactic relations, and graph structure to capture the vulnerability information in the code, which effectively realizes the complementary information of multiple IRCs and improves vulnerability detection performance. Specifically, VulMPFF extracts serialized abstract syntax tree as IRC from code sequence, lexical and syntactic relation perspective, and code property graph as IRC from graph structure perspective, and uses Bi-LSTM model with attention mechanism and graph neural network with attention mechanism to learn the code features from multiple perspectives and fuse them to detect the vulnerabilities in the code, respectively. We design a dual-attention mechanism to highlight critical code information for vulnerability triggering and better accomplish the vulnerability detection task. We evaluate our approach on three datasets. Experiments show that VulMPFF outperforms existing state-of-the-art vulnerability detection methods (i.e., Rats, FlawFinder, VulDeePecker, SySeVR, Devign, and Reveal) in Acc and F1 score, with improvements ranging from 14.71% to 145.78% and 152.08% to 344.77%, respectively. Meanwhile, experiments in the open-source project demonstrate that VulMPFF has the potential to detect vulnerabilities in real-world environments.

Python source code vulnerability detection with named entity recognition

Vulnerabilities within source code have grown over the last 20 years to become a common threat to systems and networks. As the implementation of open-source software continues to develop, more unknown vulnerabilities will exist throughout system networks. This research proposes an enhanced vulnerability detection method specific to Python source code that utilizes pre-trained, BERT-based transformer models to apply tokenization, embedding, and named entity recognition (a natural language processing technique). The use of named entity recognition not only allows for the detection of potential vulnerabilities, but also for the classification of different vulnerability types. This research uses the publicly available CodeBERT, RoBERTa, and DistilBERT models to fine-tune for the downstream task of token classification for six different common weakness enumeration specifications. The results achieved in this research outperform previous Python-based vulnerability detection methods and demonstrate the effectiveness of applying named entity recognition to enhance the overall research into Python source code vulnerabilities.

DA-GNN: A smart contract vulnerability detection method based on Dual Attention Graph Neural Network

A smart contract is an automated computer program based on blockchain technology. In recent years, the security incidents of smart contracts have caused serious economic losses. However, existing smart contract vulnerability detection methods rely on fixed expert rules, resulting in reduced detection accuracy and scalability. Therefore, addressing the issues of low accuracy in traditional smart contract vulnerability detection methods and the insufficient feature extraction in neural network-based approaches for smart contracts, this paper introduces an intelligent contract vulnerability identification method, Dual Attention Graph Neural Network (DA-GNN). Firstly, DA-GNN transforms the operation code sequence of nodes in the smart contract Control Flow Graph (CFG) into a feature matrix of semantic features and relationships between nodes based on the five types of instructions we propose. Secondly, our proposed dual attention mechanism introduces node semantic features and relationship features between nodes into the GAT to achieve node embedding updates. The updated graph node information is fused through self-attention mechanism to obtain the graph features. Then, the classification and prediction of vulnerabilities are achieved through the classification module. Finally, we evaluated our method on 17,670 real smart contracts. The experimental results show that the precision in detecting integer overflow vulnerabilities, self-destruct vulnerabilities, and transaction sequence dependency vulnerabilities reaches 72.17%, 67.03%, and 73.66%, respectively.

Smart Contract Vulnerability Detection Based on Multi-Scale Encoders

Vulnerabilities in smart contracts may trigger serious security events, and the detection of smart contract vulnerabilities has become a significant problem. In this paper, to solve the limitations of current deep learning-based vulnerability detection methods in extracting various code critical features, using the multi-scale cascade encoder architecture as the backbone, we propose a novel Multi-Scale Encoder Vulnerability Detection (MEVD) approach to hit well-known high-risk vulnerabilities in smart contracts. Firstly, we use the gating mechanism to design a unique Surface Feature Encoder (SFE) to enrich the semantic information of code features. Then, by combining a Base Transformer Encoder (BTE) and a Detail CNN Encoder (DCE), we introduce a dual-branch encoder to capture the global structure and local detail features of the smart contract code, respectively. Finally, to focus the model’s attention on vulnerability-related characteristics, we employ the Deep Residual Shrinkage Network (DRSN). Experimental results on three types of high-risk vulnerability datasets demonstrate performance compared to state-of-the-art methods, and our method achieves an average detection accuracy of 90%.

Smart Contract Vulnerability Detection Method Based on Feature Graph and Multiple Attention Mechanisms

Smart Contract Vulnerability Detection Method Based on Feature Graph and Multiple Attention Mechanisms

MVulPreter: A Multi-Granularity Vulnerability Detection System With Interpretations

Due to the powerful automatic feature extraction, deep learning-based vulnerability detection methods have evolved significantly in recent years. However, almost all current work focuses on detecting vulnerabilities at a single granularity (<i>i.e</i>., slice-level or function-level). In practice, slice-level vulnerability detection is fine-grained but may contain incomplete vulnerability details. Function-level vulnerability detection includes full vulnerability semantics but may contain vulnerability-unrelated statements. Meanwhile, they pay more attention to predicting whether the source code is vulnerable and cannot pinpoint which statements are more likely to be vulnerable. In this paper, we design <i>mVulPreter</i>, a multi-granularity vulnerability detector that can provide interpretations of detection results. Specifically, we propose a novel technique to effectively blend the advantages of function-level and slice-level vulnerability detection models and output the detection results&#x0027; interpretation only by the model itself. We evaluate <i>mVulPreter</i> on a dataset containing 5,310 vulnerable functions and 7,601 non-vulnerable functions. The experimental results indicate that <i>mVulPreter</i> outperforms existing state-of-the-art vulnerability detection approaches (<i>i.e</i>., <i>Checkmarx</i>, <i>FlawFinder</i>, <i>RATS</i>, <i>TokenCNN</i>, <i>StatementLSTM</i>, <i>SySeVR</i>, and <i>Devign</i>).

A New Smart Contract Anomaly Detection Method by Fusing Opcode and Source Code Features for Blockchain Services

Digital assets involved in smart contracts are on the rise. Security vulnerabilities in smart contracts have resulted in significant losses for the blockchain community. Existing smart contract vulnerability detection techniques have been typically single-purposed and focused only on the source code or opcode of contracts. This paper presents a new smart contract vulnerability detection method, which extracts features from different levels of smart contracts to train machine learning models for effective detection of vulnerabilities. Specifically, we propose to extract 2-gram features from the opcodes of smart contracts and token features from the source code using a pre-trained CodeBERT model, thereby capturing the semantic information of smart contracts at different levels. The 2-gram and token features are separately aggregated and then fused and input into machine-learning models to mine the vulnerability features of contracts. Over 10,266 smart contracts are used to verify the proposed method. Widespread reentrancy, timestamp dependence, and transaction-ordering dependence vulnerabilities are considered. Experiments show the fused features can help significantly improve smart contract vulnerability detection compared to the single-level features. The detection accuracy is as high as 98%, 98% and 94% for the three vulnerabilities, respectively. The average detection time is 0.99 second per contract, indicating the proposed method is suitable for automatic batch detection of vulnerabilities in smart contracts.

A software vulnerability detection method based on deep learning with complex network analysis and subgraph partition

A software vulnerability detection method based on deep learning with complex network analysis and subgraph partition

A Smart Contract Vulnerability Detection Method Based on Multimodal Feature Fusion and Deep Learning

With the proliferation of blockchain technology in decentralized applications like decentralized finance and supply chain and identity management, smart contracts operating on a blockchain frequently encounter security issues such as reentrancy vulnerabilities, timestamp dependency vulnerabilities, tx.origin vulnerabilities, and integer overflow vulnerabilities. These security concerns pose a significant risk of causing substantial losses to user accounts. Consequently, the detection of vulnerabilities in smart contracts has become a prominent area of research. Existing research exhibits limitations, including low detection accuracy in traditional smart contract vulnerability detection approaches and the tendency of deep learning-based solutions to focus on a single type of vulnerability. To address these constraints, this paper introduces a smart contract vulnerability detection method founded on multimodal feature fusion. This method adopts a multimodal perspective to extract three modal features from the lifecycle of smart contracts, leveraging both static and dynamic features comprehensively. Through deep learning models like Graph Convolutional Networks (GCNs) and bidirectional Long Short-Term Memory networks (bi-LSTMs), effective detection of vulnerabilities in smart contracts is achieved. Experimental results demonstrate that the proposed method attains detection accuracies of 85.73% for reentrancy vulnerabilities, 85.41% for timestamp dependency vulnerabilities, 83.58% for tx.origin vulnerabilities, and 90.96% for integer Overflow vulnerabilities. Furthermore, ablation experiments confirm the efficacy of the newly introduced modal features, highlighting the significance of fusing dynamic and static features in enhancing detection accuracy.

Tensor‐based gated graph neural network for automatic vulnerability detection in source code

AbstractThe rapid expansion of smart devices leads to the increasing demand for vulnerability detection in the cyber security field. Writing secure source codes is crucial to protect applications and software. Recent vulnerability detection methods are mainly using machine learning and deep learning. However, there are still some challenges, how to learn accurate source code semantic embedding at the function level, how to effectively perform vulnerability detection using the learned semantic embedding of source code and how to solve the overfitting problem of learning‐based models. In this paper, we consider codes as various graphs with node features and propose a tensor‐based gated graph neural network called TensorGNN to produce code embedding for function‐level vulnerability detection. First, we propose a high‐dimensional tensor for combining different code graph representations. Second, inspired by the work of tensor technology, we propose the TensorGNN model to produce accurate code representations using the graph tensor. We evaluate our model on 7 C and C++ large open‐source code corpus (e.g. SARD&amp;NVD, Debian, SATE IV, FFmpeg, libpng&amp;LibTiff, Wireshark and Github datasets), which contains 13 types of vulnerabilities. Our TensorGNN model improves on existing state‐of‐the‐art works by 10%–30% on average in terms of vulnerability detection accuracy and F1, while our TensorGNN model needs less training time and model parameters. Specifically, compared with other existing works, our model reduces 25–47 times of the number of parameters and decreases 3–10 times of training time. Results of evaluations show that TensorGNN has better performance while using fewer training parameters and less training time.

Vulnerability detection based on federated learning

Context:Detecting potential vulnerabilities is a key step in defending against network attacks. However, manual detection is time-consuming and requires expertise. Therefore, vulnerability detection must require automated techniques. Objective:Vulnerability detection methods based on deep learning need to rely on sufficient vulnerable code samples. However, the problem of code islands has not been extensively researched. For example, in the case of multi-party vulnerability data, how to securely combine multi-party data to improve vulnerability detection performance. From the perspectives of data augmentation and data security, we propose a vulnerability detection framework based on federated learning (VDBFL). VDBFL is a new model for vulnerability code detection that combines multi-party data. Method:Firstly, VDBFL utilizes the code property graph as a code representation. The code property graph contains various semantic dependencies of the code. Secondly, VDBFL utilizes graph neural networks and convolutional neural networks as the code feature extractor. VDBFL utilizes the jump-structured graph attention network to aggregate node information of important neighbors. Finally, VDBFL utilizes horizontal federated learning to train a local vulnerability detection model for the client. Result:In the real world, VDBFL improves F1-Score by 37.4% compared to the vulnerability detection method Reveal. Among the 5401 vulnerability samples, VDBFL detected 11.8 times more vulnerabilities than Reveal. Conclusion:Under different datasets, VDBFL has shown better performance than advanced vulnerability detection methods in multiple metrics. In addition, the federated learning stage of VDBFL can be expanded on top of the feature extraction stage of any vulnerable detection method.

A Static Detection Method for SQL Injection Vulnerability Based on Program Transformation

Static analysis is popular for detecting SQL injection vulnerabilities. However, due to the lack of accurate modeling of object-oriented database extensions, current methods fail to accurately detect SQL injection vulnerabilities in applications that use object-oriented database extensions. We propose a program transformation-based SQL injection vulnerability detection method to address this issue. This method consists of two stages: program transformation and vulnerability detection. In the first stage, object-oriented database extensions are automatically transformed into semantically equivalent procedural database extensions through the identification of key statements, call relation verification, and program transformation. In the second stage, application programs are automatically scanned using a combination of control flow graph construction and taint analysis techniques to detect SQL injection vulnerabilities. Based on the proposed method, we have implemented the OODBE-SCAN prototype system and performed experimental analysis on eight modern PHP applications. We compare OODBE-SCAN with two related static analysis tools, RIPS and Seay. The results show that OODBE-SCAN can detect more real-world vulnerabilities and has higher accuracy than existing methods.

A vulnerability detection algorithm based on residual graph attention networks for source code imbalance (RGAN)

It is essential to detect potential vulnerabilities in software to ensure its safety. As software systems become more complex, traditional static vulnerability detection methods perform poorly. Currently, deep learning-based vulnerability detection models only extract source code vulnerability features using sequences or graphs. Sequential neural networks ignore structural information in the code, such as control flow diagrams and data flow diagrams. Additionally, graph neural networks cannot accurately extract features due to the lack of effective methods for extracting nodes’ features and aggregating global information. To address the above issue, we propose a vulnerability detection algorithm based on residual graph attention networks for source code imbalance (RGAN). Firstly, a local feature extraction module (PE-BL-A module) is designed. Using the sequence neural network, the module extracts various useful features, including node features in a control flow diagram based on local semantic features. Secondly, we present the Residual Graph Attention Network module (RGAT). To learn and update node features along the control flow direction, the module uses a graph attention network with residual connections. In this module, a mean biaffine attention pooling mechanism is proposed that can extract total graph vulnerability features more effectively. Thirdly, a dynamic cross-entropy loss function is designed. Using this function, it can handle sample imbalances during training. Finally, experiments conducted on several benchmark datasets demonstrate that the proposed model achieves state-of-the-art results.