Vulnerability Functions Research Articles

Distilled and Contextualized Neural Models Benchmarked for Vulnerable Function Detection

Detecting vulnerabilities in programs is an important yet challenging problem in cybersecurity. The recent advancement in techniques of natural language understanding enables the data-driven research on automated code analysis to embrace Pre-trained Contextualized Models (PCMs). These models are pre-trained on the large corpus and can be fine-tuned for various downstream tasks, but their feasibility and effectiveness for software vulnerability detection have not been systematically studied. In this paper, we explore six prevalent PCMs and compare them with three mainstream Non-Contextualized Models (NCMs) in terms of generating effective function-level representations for vulnerability detection. We found that, although the detection performance of PCMs outperformed that of the NCMs, training and fine-tuning PCMs were computationally expensive. The budgets for deployment and inference are also considerable in practice, which may prevent the wide adoption of PCMs in the field of interest. However, we discover that, when the PCMs were compressed using the technique of knowledge distillation, they achieved similar detection performance but with significantly improved efficiency compared with their uncompressed counterparts when using 40,000 synthetic C functions for fine-tuning and approximately 79,200 real-world C functions for training. Among the distilled PCMs, the distilled CodeBERT achieved the most cost-effective performance. Therefore, we proposed a framework encapsulating the Distilled CodeBERT for an end-to-end Vulnerable function Detection (named DistilVD). To examine the performance of the proposed framework in real-world scenarios, DistilVD was tested on four open-source real-world projects with a small amount of training data. Results showed that DistilVD outperformed the five baseline approaches. Further evaluations on multi-class vulnerability detection also confirmed the effectiveness of DistilVD for detecting various vulnerability types.

VULDEFF: Vulnerability detection method based on function fingerprints and code differences

The significant increase in Open Source Software has led to a sharp increase in code cloning vulnerabilities. Code similarity detection methods are usually used to detect these vulnerabilities. However, cloned code often modifies the original code to varying degrees, and the difference between vulnerable code and patch code can be very small. Traditional code similarity detection methods cannot effectively detect common mutation patterns in code cloning and distinguish vulnerable code from patch code. The paper proposes a vulnerability detection method named VULDEFF based on function fingerprints and code differences. This paper designs a lightweight function fingerprint method based on the Context Triggered Piecewise Hashing algorithm, which can characterize the basic syntax features of function source code. In particular, the fingerprint of the vulnerable function contains the syntax features, vulnerability features, and patch features of the vulnerable function. VULDEFF detects whether target function has vulnerabilities by searching target function fingerprint in the vulnerable function fingerprint library. Compared with five advanced software vulnerability detection tools, VULDEFF significantly reduces the false positive and false negative rates while ensuring the scalability of vulnerability detection. VULDEFF discovered 111 new vulnerabilities in 10 open source projects.

A STUDY ON SEISMIC GROUND MOTION INTENSITY TO ESTIMATE THE DAMAGE RATES OF LOW- AND MIDDLE-RISE REINFORCED CONCRETE BUILDINGS IN THE SHIKOKU REGION

This study investigated seismic ground motion intensity to estimate the damage rates of low- and middle-rise RC buildings due to various earthquakes. It calculated the vulnerability functions of analytical models of RC buildings for earthquake motions with different spectral characteristics and evaluated the effects of earthquake motions with different spectral characteristics on vulnerability functions. The results confirmed that the average acceleration response spectrum of the periodic band corresponding to the primary natural period of the building can usually estimate the damage rates of low- and middle-rise RC buildings due to various earthquakes.

Integrated seismic risk assessment in Nepal

Abstract. Seismic risk analysis is necessary to mitigate the potential losses resulting from future earthquakes and supplement scientific risk management. In order to assist systematic evaluation and management of risk, it is indispensable to interpret risk in terms of social and economic consequences due to hazardous events like earthquakes. There is an interrelationship between hazards, physical risk, and the social characteristics of populations. Therefore, based on the existing studies focusing on each of these aspects, this paper presents the integrated seismic risk assessment along the subdivisional administrative units of Nepal using 2011 census data. The administrative unit “provinces” are subdivided into districts and each district into municipalities and village development committees (VDCs). The districts, municipalities, and VDCs were considered as our study units. In this paper, the physical or seismic risk was evaluated from the exposure model, hazard curves, and the vulnerability model of the country, whereas the social vulnerability was assessed using social vulnerability index (SoVI) methods. To formulate the physical risk, the assets used were five types of buildings under the exposure model. This model was combined with the physical vulnerability functions of the building and the hazard curves of the country. The result of the physical risk has been presented as annual average loss (AAL). Similarly, among 92 social vulnerability variables, 54 variables were reduced to 7 weighted parameters using principal component analysis (PCA). The scores of a total of 45 parameters were used to evaluate the SoVI index, which was further combined with the physical risk to evaluate integrated risk. The results showed that populated cities like Kathmandu, Hetauda, and Janakpur have a highly integrated risk index. Similarly, the Terai region bordering its neighbor India and some parts of the central hilly region are highly vulnerable, while most parts of the mountainous region in the central and eastern regions are the least vulnerable. The results from the present study can be utilized as a part of a comprehensive risk management framework at the district level to recuperate and recover from earthquakes.

Human vulnerability modeling and risk analysis of railway transportation of hazardous materials

People who live in densely populated regions could be at risk of mishaps that occur during hazardous materials (hazmat) transportation. Population vulnerability assessment is an essential parameter for developing risk mitigation strategies to prevent negative consequences of hazmat transportation incidents. In this study, a procedure is developed to estimate the risk of hazmat railway incidents, focused on two parts. First, the most probable and the most dangerous meteorological variables (e.g., stability class, wind speed, solar radiation, etc.) are processed to simulate threat zones and prepare hazard maps using the ALOHA software. Second, sociodemographic characteristics (e.g., age, sex, education, household, income, employment, etc.) of the affected population are used to create vulnerability maps along with their weights. As risk is a function of hazard and vulnerability, risk maps are generated by superimposing the hazard and vulnerability maps using ArcGIS software. This procedure is tested in a city in Canada and confirms the significance of integrating population vulnerability in risk assessment by revealing that the areas with high hazards indicated on the hazard maps are not necessarily considered as the areas with high risk indicated on the risk maps. The risk maps generated in this study can be used to provide recommendations to improve land-use planning, enhance the safety of the people, living in higher-risk areas, and prioritize emergency response decisions. The procedure developed in this study can also be applied to different types of railway incidents and other potential incidents in the transportation industry when all the necessary information is available, such as regional meteorological conditions and the characteristics of the affected population.

Multi-hazard resilience assessment framework for prefabricated underground stations with a large-span roof structure

Prefabricated underground stations (PUSs) have been gradually applied as a new approach to urban low-carbon development; however, safe service for the city over the entire PUS life cycle remains a crucial issue. This study therefore investigates the resilience of PUSs with a large-span roof structure in multi-hazard urban environments. A joint vulnerability function is established to represent the PUS physical resilience, and a restorability function is established to represent the local community resilience. The physical resilience and community resilience are integrated to construct a PUS resilience assessment framework (PUS-RAF). The results indicates that: (1) the vulnerability function, experiment and FEA jointly present the PUS assembled joints' contact failure mode; (2) multi-hazard resilience assessment reveals the inherent sensitivity of PUS schemes (3) PUS-RAF predicts a joint scheme highly inclusive of multi-hazard factor; (4) the final PUS scheme accommodates the engineering and community. The PUS-RAF thus provides a practical assessment tool and application value for PUS resilience in multi-hazard environment.

RiskScape: a flexible multi-hazard risk modelling engine

This paper presents the architecture and features of RiskScape software. RiskScape is an open-source software with a flexible modelling engine for multi-hazard risk analysis. The RiskScape engine implements modeller-defined risk quantification workflows as ‘model pipelines’. Model pipeline steps and functions analyse hazard, exposure, and vulnerability data across different spatio-temporal domains using geoprocessing and spatial sampling operations. The RiskScape engine supports deterministic and probabilistic risk quantification, with several probabilistic-based modes described in this paper. RiskScape advances modelling software for multi-hazard risk analysis through several implementation features. The RiskScape engine operates model pipelines independent of system prescribed model input data classifications or standards. Multiple hazard types, metric intensities, and temporal occurrence information is geometry processed and sampled to create coverage data of simultaneous or sequenced multi-hazard events at object-exposure locations. Escalating multi-hazard event impacts are then determined for object-exposures using scripted conditional or nested statements that apply vulnerability functions in a logical sequence of temporal hazard and impact occurrence. These model features, supported by open geospatial consortium standard geospatial data files and operations, expedite RiskScape for modelling multi-hazard risk at any geographical location or scale.

Species, taxonomic, and functional group diversities of terrestrial mammals at risk under climate change and land-use/cover change scenarios in Mexico.

There is a need to revise the framework used to project species risks under climate change (CC) and land-use/cover change (LUCC) scenarios. We built a CC risk index using the latest Intergovernmental Panel on Climate Change framework, where risk is a function of vulnerability (sensitivity and adaptive capacity), exposure, and hazard. We incorporated future LUCC scenarios as part of the exposure component. We combined a trait-based approach based on biological characteristics of species with a correlative approach based on ecological niche modeling, assigning risk scores to species, taxonomic (orders), and functional (trophic, body size, and locomotion) groups of terrestrial mammals occurring in Mexico. We identified 15 species projected to lose their climatic suitability. Of the 11 taxonomic orders, Eulipotyphla, Didelphimorphia, Artiodactyla, and Lagomorpha had the highest risk scores. Of the 19 trophic groups, piscivores, insectivores under canopy, frugivores-granivores, herbivores browser, and myrmecophagous had the highest risk scores. Of the five body-sized groups, large-sized species (>15 kg) had highest risk scores. Of the seven locomotion groups, arboreal and semi-aquatics had highest risk scores. CC and LUCC scenarios reduced suitable areas of species potential distributions by 37.5% (with CC), and 51% (with CC and LUCC) under a limited full-dispersal assumption. Reductions in suitable areas of species potential distributions increased to 50.2% (with CC), and 52.4% (with CC and LUCC) under a non-dispersal assumption. Species-rich areas (>75% species) projected 36% (with CC) and 57% (with CC and LUCC) reductions in suitability for 2070. Shifts in climatic suitability projections of species-rich areas increased in number of species in northeast and southeast Mexico and decreased in northwest and southern Mexico, suggesting important species turnover. High-risk projections under future CC and LUCC scenarios for species, taxonomic, and functional group diversities, and species-rich areas of terrestrial mammals highlight trends in different impacts on biodiversity and ecosystem function.

Total probabilistic measure for the potential risk of regional roads exposed to landslides

This paper presents a probabilistic analysis of the landslide risk encountered by regional roads, and the landslide risk of roads is regarded as a function of landslide hazard and road vulnerability. First, a hazard model considering the interdependence of time, space, and the magnitude of landslides was developed to express the landslide probability. Meanwhile, a probabilistic landslide vulnerability was introduced into the road vulnerability to show the vulnerable locations, damage states, and the damage probabilities of the road. Finally, the road risk exposed to landslides was formulated as the product of hazard and vulnerability. Results show that the probability of the regional road reaching a specific damage state varies with the time interval, landslide scale, and spatial location. Geographically, the Mudanjiang-Suifenhe line maintains a high-risk level; while, in terms of the risk evolution in time and scale, the maximum value of failure probability faced by the road network is 0.047, 0.364, and 0.603 for small-scale, medium-scale, and large-scale landslides in the next 10 years; and 0.049, 0.467, and 0.618 for small-scale, medium-scale, and large-scale landslides in the next 30 years. This study provides guidance for the hierarchical management and prevention of disaster risk for regional roads in different periods.

Firmware Vulnerabilities Homology Detection Based on Clonal Selection Algorithm for IoT Devices

With the wide application of Internet of Things (IoT) devices, security attacks against their firmware often occur, which has attracted more attention from the research community. Firmware is an important part of IoT devices, and attacks against them is one of the main means to destroy them. Therefore, firmware security is considered a core of the overall devices’ security. At present, most of the firmware vulnerabilities have a small number of related samples, so it is difficult to use machine learning methods to generate detectors for some of them. Therefore, based on the collected data of related firmware vulnerabilities, this article proposes a firmware vulnerability homology detection method based on the clonal selection algorithm. We design the numerical and structural characteristics of vulnerability functions, train a detector for each function separately, and improve the recall rate of vulnerability detection. Compared with existing machine learning methods, this method only depends on the affinity between the objective function and the detector, which avoids the requirement of a large number of sample data sets. Finally, relevant experiments are carried out to verify the effectiveness of the method.

Flood risk assessment for road infrastructures using Bayesian networks: case study of Santarem - Portugal

Assessing flood risks on road infrastructures is critical for the definition of mitigation strategies and adaptation processes. Some efforts have been made to conduct a regional flood risk assessment to support the decision-making process of exposed areas. However, these approaches focus on the physical damage of civil infrastructures without considering indirect impacts resulting from social aspects or traffic delays due to the functionality loss of transportation infrastructures. Moreover, existing methodologies do not include a proper assessment of the uncertainties involved in the risk quantification. This work aims to provide a consistent quantitative flood risk estimation and influence factor modelling for road infrastructures. To this end, a Flood Risk Factor (FRF) is computed as a function of hazard, vulnerability, and infrastructure importance factors. A Bayesian Network (BN) is constructed for considering the interdependencies among the selected input factors, as well as accounting for the uncertainties involved in the modelling process. The proposed approach allows weighting the relevant factors differently to compute the FRF and improves the understanding of the causal relations between them. The suggested method is applied to a case study located in the region of Santarem Portugal, allowing the identification of the sub-basins where the road network has the highest risks and illustrating the potential of Bayesian inference techniques for updating the model when new information becomes available.

Autism-associated mutation in Hevin/Sparcl1 induces endoplasmic reticulum stress through structural instability

Hevin is a secreted extracellular matrix protein that is encoded by the SPARCL1 gene. Recent studies have shown that Hevin plays an important role in regulating synaptogenesis and synaptic plasticity. Mutations in the SPARCL1 gene increase the risk of autism spectrum disorder (ASD). However, the molecular basis of how mutations in SPARCL1 increase the risk of ASD is not been fully understood. In this study, we show that one of the SPARCL1 mutations associated with ASD impairs normal Hevin secretion. We identified Hevin mutants lacking the EF-hand motif through analyzing ASD-related mice with vulnerable spliceosome functions. Hevin deletion mutants accumulate in the endoplasmic reticulum (ER), leading to the activation of unfolded protein responses. We also found that a single amino acid substitution of Trp647 with Arg in the EF-hand motif associated with a familial case of ASD causes a similar phenotype in the EF-hand deletion mutant. Importantly, molecular dynamics (MD) simulation revealed that this single amino acid substitution triggers exposure of a hydrophobic amino acid to the surface, increasing the binding of Hevin with molecular chaperons, BIP. Taken together, these data suggest that the integrity of the EF-hand motif in Hevin is crucial for proper folding and that ASD-related mutations impair the export of Hevin from the ER. Our data provide a novel mechanism linking a point mutation in the SPARCL1 gene to the molecular and cellular characteristics involved in ASD.

Earthquake Risk Study on Residential Buildings in West Jakarta using the Event-Based Risk Analysis Method

UNISDR (United Nations Office for Disaster Reduction) states that Indonesia is in the third-highest rank after Japan and the United States for the average economic loss due to earthquakes. Previous earthquake risk studies conducted by the National Agency for Disaster Management (BNPB) in 2011 renewed in 2016 both in the form of risk indexes have yet taken into account the vulnerability function of buildings, so that economic loss has not been presented quantitatively. This research aims to analyse earthquake risk in urban areas (West Jakarta Municipality) using the Event-Based Risk Analysis method by applying several factors including: earthquake source updates, GMPE, site-specific, exposure and building vulnerability functions. Hazard and risk analyses have been conducted for the probability of exceedance (PoEs) 10% and 2% in 50 years. Moreover, risk analysis was conducted for residential buildings exposure. The results predict that the lowest total building loss due to the earthquake per district is around 8.1 million USD and the highest loss is 15.5 million USD at a PoEs 10% in 50 years. Whereas for the PoEs 2% in 50 years, the lowest total loss was 14.86 million USD whilst the highest total loss was 25 million USD.

Research on entropy weight multiple criteria decision‐making evaluation of metro network vulnerability

AbstractWhen the subway network system has insufficient resilience and strong vulnerability, the network operation function will be greatly attenuated or even lost due to the failure of key nodes or lines. Evaluating the vulnerability of the metro network is one of the keys to prevent and control risks. This paper proposes an entropy weight multiple criteria decision‐making evaluation method that combines the vulnerability indexes of agglomeration, network efficiency, and network traffic with the multiple criteria decision‐making method, classifies the vulnerability of subway stations with a clustering idea, and analyzes the most vulnerable area of the Beijing Metro network with the Newman fast algorithm. The results show that this method can evaluate the node vulnerability of metro networks more accurately and effectively by considering the topological vulnerability, functional vulnerability, and human flow function vulnerability of the networks. According to the node vulnerability value, the stations can be divided into five grades: The station at the intersection of the loop and radial lines and its adjacent stations have a higher vulnerability level. The vulnerability level of the downtown core area and suburban line terminal stations is relatively low, and the areas with the greatest vulnerability of the Beijing Metro network are mainly located on the east and west sides of the core city.

Featherweight assisted vulnerability discovery

Predicting vulnerable source code helps to focus attention on those parts of the code that need to be examined with more scrutiny. Recent work proposed the use of function names as semantic cues that can be learned by a deep neural network (DNN) to aid in the hunt for vulnerability of functions. Combining identifier splitting, which splits each function name into its constituent words, with a novel frequency-based algorithm, we explore the extent to which the words that make up a function's name can predict potentially vulnerable functions. In contrast to *lightweight* predictions by a DNN that considers only function names, avoiding the use of a DNN provides *featherweight* predictions. The underlying idea is that function names that contain certain "dangerous" words are more likely to accompany vulnerable functions. Of course, this assumes that the frequency-based algorithm can be properly tuned to focus on truly dangerous words. Because it is more transparent than a DNN, the frequency-based algorithm enables us to investigate the inner workings of the DNN. If successful, this investigation into what the DNN does and does not learn will help us train more effective future models. We empirically evaluate our approach on a heterogeneous dataset containing over 73000 functions labeled vulnerable, and over 950000 functions labeled benign. Our analysis shows that words alone account for a significant portion of the DNN's classification ability. We also find that words are of greatest value in the datasets with a more homogeneous vocabulary. Thus, when working within the scope of a given project, where the vocabulary is unavoidably homogeneous, our approach provides a cheaper, potentially complementary, technique to aid in the hunt for source-code vulnerabilities. Finally, this approach has the advantage that it is viable with orders of magnitude less training data.

Development of hybrid earthquake vulnerability functions for typical residential buildings in Iran

Residential building stock in Iran, with its diverse types, is exposed to different earthquake events each year that necessities the implementation of disaster risk reduction measures. Conducting seismic risk assessment studies, on the other hand, is crucial as one of the main perquisites of any earthquake disaster risk reduction efforts. Seismic risk assessment is an approach that requires dependable fragility or vulnerability functions, and the more valid these models are, the more realistic the risk assessment results would be. The main objective of the current study is to provide new hybrid seismic vulnerability models for typical residential buildings in Iran. In this regard, existing peer-reviewed fragility or vulnerability models are utilized as basic models besides the damage records of recent earthquake events in Iran. The logic tree approach is used to combine the basic models, and 26 seismic vulnerability models are developed based on three main attributes of material type, construction quality, and building height. The developed models are functions of PGA and are in the form of the cumulative lognormal distribution function. Additionally, the most recent national census data (2016) are utilized to combine vulnerability models via the logic tree approach and develop quality-independent vulnerability models that can be used in circumstances when precise information about the construction quality of buildings is not available. Developed models are finally validated using the real building damage data collected from the records of recent significant earthquake events in Iran.

Analysis of probability matrix model for seismic damage vulnerability of highway bridges

The present study was aimed at assessing more accurately the seismic vulnerability and performance of highway bridges in an earthquake-damaged area. Based on mathematical statistics (data collection) and a probability model, (i) survey data for 2134 bridges in 22 highway sections (47 sub-sections) affected by the Wenchuan earthquake on May 12, 2008 were obtained and analysed, (ii) Gaussian and exponential regression models were developed, (iii) the empirical seismic-damage vulnerability function, plane, surface and curve model of the 22 highway sections with sample number and failure ratio were established, and (iv) a regression parameter matrix was constructed considering the empirical seismic-damage data. Using the method of probability exceedance, the bridge vulnerability curve models considering the seismic-damage exceedance probability of each section were analysed, and a parameter matrix model (mean seismic-damage index) was proposed to evaluate and predict the seismic vulnerability of regional bridges. Based on creating the actual seismic-damage sample database, vulnerability point-cloud models of the 22 highway bridges were constructed, and the vulnerability probability matrix, function, curve and point-cloud model of each highway section can be used to evaluate and estimate the vulnerability of regional bridges in the future.

Seismic resilience assessment of buildings: A simplified methodological approach through conventional seismic risk assessment

A simplified methodology to evaluate seismic resilience of buildings through a probabilistic risk assessment is proposed. The methodology uses the results from the conventional seismic risk assessment with the inclusion of social and economic aspects. The seismic resilience assessment process considers the workforce population, repair time, direct and indirect losses. They can be applied within the damage definition stage with the aim of the vulnerability functions for a specific building typology, and loss estimation stage of the probabilistic risk assessment. For the case of the definition of vulnerability functions a previous methodological approach is used with fewer modifications. In addition, a new risk figure called average annual repair time is introduced in the probabilistic risk assessment allowing to obtain the resilience index. Aspects such as expected repair time, quantities of crew members, business interruption losses, workforce population capacity and risk figures: average annual loss, probable maximum loss and average annual repair time are considered. Then, all those aspects are integrated within the exposure, damage, and loss estimation models with additional considerations to perform the calculation of the resilience. Finally, the results are represented by means of a unitless simplified resilience index allowing to be compared among different scenarios. The methodology is illustrated using two study cases. The first one represented its application at damage definition stage and is comprised by 3-, 6- and 9-story reinforced concrete moment resisting frame school buildings designed for special seismic code level. The second one covered the application at loss estimation stage and considers a fictitious portfolio of approximately 190,000 buildings composed by the previous three building typologies located along the whole country of Peru. The results show a highly sensitivity associated to workforce population, repair time, and indirect losses. Conclusions and possible applications related to Disaster Risk Reduction are summarized.

Shear walls optimization in a reinforced concrete framed building for seismic risk reduction

Seismic hazards represent a permanent threat to buildings. The paper argues that risk-oriented approaches provide an interesting solution to account for the long-term resilience of buildings, both for the design of new structures and the rehabilitation of existing ones. The proposed research draws upon the standard definition of risk as a function of vulnerability, hazard and exposure to develop an optimization-based methodology for risk appraisal of buildings in seismic conditions. The proposed methodology allows to identify the optimum layout and thickness of shear walls in a reinforced concrete frame, based on a target risk performance. This is achieved through the coupling of an evolutionary computing environment with an object-oriented structural analysis tool, involving its native Application Programming Interface (API). The latter allows to automate the search for the optimum shear wall configuration solution. The research is validated on the Beichuan Hotel building in Old Beichuan (China), heavily affected by the 2008 Wenchuan Earthquake. The paper evidences that the adoption of the proposed methodology leads to a risk reduction of about 80% compared to the as-built scenario, with additional benefits from both a financial and building functionality perspective.

Effect of Boulder Size on Debris Flow Impact Pressure Using a CFD-DEM Numerical Model

Debris flows (DFs) are dangerous events that can cause the complete destruction of buildings and infrastructure, such as bridges; DFs therefore represent a high risk to public safety in exposed areas. The impact pressures due to these flows are essentially determined by the flow height, velocity and density, but other parameters that are less often considered are also involved. We developed a numerical model to evaluate the impact pressure of mass flows, focusing on a better description of the influence of the blocks transported in these flows: the block size strongly influences the impact pressure, which has a strong effect on structural damage. The numerical model proposed considers a staggered, loosely one-way granular–fluid coupling based on a distinct-element-method code, using the separate simulation results of a computing fluid dynamics code used to model the fluid phase. This model estimates the impact pressure distribution due to blocks at the local scale of the obstacle; the pressure due to the fluid phase can be added afterwards. The pressure applied by the DF increased with the maximum block size for a given set of DF characteristics: velocity, height and apparent density. The vulnerability of a given structure depends on the intensity of DFs: the pressure applied on the structure is one of considerable intensity. The existing vulnerability functions are interpreted in the light of the results obtained with the numerical model. This interpretation highlights the need to integrate new parameters in the intensity to better evaluate structures’ vulnerability to debris flows.