检索结果-南通市图书馆

HCRVD: A vulnerability detection System Based on CST-PDG Hierarchical Code Representation Learning

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Computers, Materials & Continua 2024年第6期79卷 4573-4601页

作者： Zhihui Song Jinchen Xu Kewei Li Zheng Shan School of Cyberspace Security Information Engineering UniversityZhengzhou450001China

Prior studies have demonstrated that deep learning-based approaches can enhance the performance of source code vulnerability detection by training neural networks to learn vulnerability patterns in code ***,due to limitations in code representation and neural network design,the validity and practicality of the model still need to be ***,due to differences in programming languages,most methods lack cross-language detection *** address these issues,in this paper,we analyze the shortcomings of previous code representations and neural *** propose a novel hierarchical code representation that combines Concrete Syntax Trees(CST)with Program Dependence Graphs(PDG).Furthermore,we introduce a Tree-Graph-Gated-Attention(TGGA)network based on gated recurrent units and attention mechanisms to build a Hierarchical Code Representation learning-based vulnerability detection(HCRVD)*** system enables cross-language vulnerability detection at the *** experiments show that HCRVD surpasses many competitors in vulnerability detection *** benefits from the hierarchical code representation learning method,and outperforms baseline in cross-language vulnerability detection by 9.772%and 11.819%in the C/C++and Java datasets,***,HCRVD has certain ability to detect vulnerabilities in unknown programming languages and is useful in real open-source *** shows good validity,generality and practicality.

关键词： vulnerability detection deep learning CST-PDG code representation tree-graph-gated-attention network cross-language

An interpretable model for large-scale smart contract vulnerability detection

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Blockchain(Research and Applications) 2024年第3期5卷 130-139页

作者： Xia Feng Haiyang Liu Liangmin Wang Huijuan Zhu Victor S.Sheng City University of Macao Macao 999078China Jiangsu University Zhenjiang 212013China Southeast University Nanjing 211189China Texas Tech University Lubbock 79409USA

Smart contracts hold billions of dollars in digital currency,and their security vulnerabilities have drawn a lot of attention in recent *** methods for detecting smart contract vulnerabilities rely primarily on symbol execution,which makes them time-consuming with high false positive ***,deep learning approaches have alleviated these issues but still face several major limitations,such as lack of interpretability and susceptibility to evasion *** this paper,we propose a feature selection method for uplifting *** fundamental concept of this method is a feature selection algorithm,utilizing interpretation outcomes to select critical features,thereby reducing the scales of *** learning process could be accelerated significantly because of the reduction of the feature *** experiment shows that our proposed model performs well in six types of vulnerability *** accuracy of each type is higher than 93%and the average detection time of each smart contract is less than 1 ***,through our proposed feature selection algorithm,the training time of each type of vulnerability is reduced by nearly 80%compared with that of its original.

关键词： Blockchain vulnerability detection Smart contract

Automated vulnerability detection of Blockchain Smart Contacts Based on BERT Artificial Intelligent Model

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

China Communications 2024年第7期21卷 237-251页

作者： Feng Yiting Ma Zhaofeng Duan Pengfei Luo Shoushan School of Cyberspace Security Beijing University of Posts and TelecommunicationsBeijing 100876China

The widespread adoption of blockchain technology has led to the exploration of its numerous applications in various *** algorithms and smart contracts are critical components of blockchain *** the benefits of virtual currency,vulnerabilities in smart contracts have resulted in substantial losses to *** researchers have identified these vulnerabilities and developed tools for detecting them,the accuracy of these tools is still far from satisfactory,with high false positive and false negative *** this paper,we propose a new method for detecting vulnerabilities in smart contracts using the BERT pre-training model,which can quickly and effectively process and detect smart *** specifically,we preprocess and make symbol substitution in the contract,which can make the pre-training model better obtain contract *** evaluate our method on four datasets and compare its performance with other deep learning models and vulnerability detection tools,demonstrating its superior accuracy.

关键词： BERT blockchain smart contract vulnerability detection

维普期刊数据库

Eth2Vec:Learning contract-wide code representations for vulnerability detection on Ethereum smart contracts

在线全文

学校读者我要写书评

暂无评论

Blockchain(Research and Applications) 2022年第4期3卷 109-122页

作者： Nami Ashizawa Naoto Yanai Jason Paul Cruz Shingo Okamura School of Information Science and Technology Osaka UniversityOsaka 565-0871Japan Osaka University Osaka 565-0871Japan National Institute of Technology Nara CollegeNara 639-1080Japan

Ethereum smart contracts are computer programs that are deployed and executed on the Ethereum blockchain to enforce agreements among untrusting *** the most prominent platform that supports smart contracts,Ethereum has been targeted by many attacks and plagued by security ***,many smart contract vulnerabilities have been discovered in the past *** detect and prevent such vulnerabilities,different security analysis tools,including static and dynamic analysis tools,have been created,but their performance decreases drastically when codes to be analyzed are constantly being *** this paper,we propose Eth2Vec,a machine-learning-based static analysis tool that detects smart contract ***2Vec maintains its robustness against code rewrites;i.e.,it can detect vulnerabilities even in rewritten *** machine-learning-based static analysis tools require features,which analysts create manually,as *** contrast,Eth2Vec uses a neural network for language processing to automatically learn the features of vulnerable *** doing so,Eth2Vec can detect vulnerabilities in smart contracts by comparing the similarities between the codes of a target contract and those of the learned *** performed experiments with existing open databases,such as Etherscan,and Eth2Vec was able to outperform a recent model based on support vector machine in terms of well-known metrics,i.e.,precision,recall,and F1-score.

关键词： Ethereum Smart contracts Blockchain Neural networks Static analysis Code similarity vulnerability detection

Double-Layer Positional Encoding Embedding Method for Cross-Platform Binary Function Similarity detection

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Chinese Journal of Electronics 2022年第4期31卷 604-611页

作者： JIANG Xunzhi WANG Shen YU Xiangzhan GONG Yuxin School of Cyberspace Science Harbin Institute of Technology

The similarity detection between two cross-platform binary functions has been applied in many fields, such as vulnerability detection, software copyright protection or malware classification. Current advanced methods for binary function similarity detection usually use semantic features, but have certain limitations. For example, practical applications may encounter instructions that have not been seen in training, which may easily cause the out of vocabulary(OOV) problem. In addition, the generalization of the extracted binary semantic features may be poor, resulting in a lower accuracy of the trained model in practical applications. To overcome these limitations, we propose a double-layer positional encoding based transformer model(DP-Transformer). The DPTransformer's encoder is used to extract the semantic features of the source instruction set architecture(ISA),which is called the source ISA encoder. Then, the source ISA encoder is fine-tuned by the triplet loss while the target ISA encoder is trained. This process is called DPMIRROR. When facing the same semantic basic block,the embedding vectors of the source and target ISA encoders are similar. Different from the traditional transformer which uses single-layer positional encoding, the double-layer positional encoding embedding can solve the OOV problem while ensuring the separation between instructions, so it is more suitable for the embedding of assembly instructions. Our comparative experiment results show that DP-MIRROR outperforms the state-of-the-art approach, MIRROR, by about 35% in terms of precision at 1.

关键词： natural language processing embedding vectors single-layer positional encoding trained model encoding DP-MIRROR current advanced methods software copyright protection double-layer positional encoding based transformer model vocabulary Data security security of data cross-platform binary function similarity detection OOV problem cross-platform binary functions source ISA encoder extracted binary semantic features Computer vision and image processing techniques copyright traditional transformer vocabulary problem DP-Transformer's encoder source instruction Natural language processing encoders invasive software double-layer positional encoding embedding method vulnerability detection semantic basic block target ISA encoder instruction sets

Saudi cloud infrastructure: a security analysis

在线全文

同方期刊数据库

学校读者我要写书评

暂无评论

Science China(Information Sciences) 2017年第12期60卷 152-164页

作者： Wahid RAJEH Hai JIN Deqing ZOU Services Computing Technology and System Lab Big Data Technology and System LabCluster and Grid Computing Lab School of Computer Science and TechnologyHuazhong University of Science and Technology School of Computers and Information Technology University of Tabuk

The growing demand and dependence upon cloud services have garnered an increasing level of threat to user data and security. Some of such critical web and cloud platforms have become constant targets for persistent malicious attacks that attempt to breach security protocol and access user data and information in an unauthorized manner. While some of such security compromises may result from insider data and access leaks, a substantial proportion continues to remain attributed to security flaws that may exist within the core web technologies with which such critical infrastructure and services are developed. This paper explores the direct impact and significance of security in the Software Development Life Cycle(SDLC) through a case study that covers some 70 public domain web and cloud platforms within Saudi Arabia. Additionally, the major sources of security vulnerabilities within the target platforms as well as the major factors that drive and influence them are presented and discussed through experimental evaluation. The paper reports some of the core sources of security flaws within such critical infrastructure by implementation with automated security auditing and manual static code analysis. The work also proposes some effective approaches, both automated and manual, through which security can be ensured through-out the SDLC and safeguard user data integrity within the cloud.

关键词： cloud security vulnerability detection web security Saudi infrastructure cloud service

MEBS: Uncovering Memory Life-Cycle Bugs in Operating System Kernels

在线全文

同方期刊数据库

学校读者我要写书评

暂无评论

Journal of Computer Science & Technology 2021年第6期36卷 1248-1268页

作者： Gen Zhang Peng-Fei Wang Tai Yue Xu Zhou Kai Lu College of Computer National University of Defense TechnologyChangsha 410073China

Allocation,dereferencing,and freeing of memory data in kernels are coherently *** widely exist real cases where the correctness of memory is *** incorrectness in kernel memory brings about significant security issues,e.g.,information *** memory allocation,dereferencing,and freeing are closely related,previous work failed to realize they are closely *** this paper,we study the life-cycle of kernel memory,which consists of allocation,dereferencing,and *** in them are called memory life-cycle(MLC)*** propose an in-depth study of MLC bugs and implement a memory life-cycle bug sanitizer(MEBS)for MLC bug *** an interprocedural global call graph and novel identification approaches,MEBS can reveal memory allocation,dereferencing,and freeing sites in *** constructing a modified define-use chain and examining the errors in the life-cycle,MLC bugs can be ***,the experimental results on the latest kernels demonstrate that MEBS can effectively detect MLC bugs,and MEBS can be scaled to different *** than 100 new bugs are exposed in Linux and FreeBSD,and 12 common vulnerabilities and exposures(CVE)are assigned.

关键词： software security operating system memory life-cycle static analysis vulnerability detection

Vulnerable Region-Aware Greybox Fuzzing

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Journal of Computer Science & Technology 2021年第5期36卷 1212-1228页

作者： Ling-Yun Situ Zhi-Qiang Zuo Le Guan Lin-Zhang Wang Xuan-Dong Li Jin Shi Peng Liu State Key Laboratory for Novel Software Technology Nanjing UniversityNanjing 210023China School of Information Management Nanjing UniversityNanjing 210023China Department of Computer Science University of GeorgiaAthensGA 30602U.S.A. College of Information Sciences and Technology Pennsylvania State UniversityState CollegePA 16802U.S.A

Fuzzing is known to be one of the most effective techniques to uncover security vulnerabilities of large-scale software *** fuzzing,it is crucial to distribute the fuzzing resource appropriately so as to achieve the best fuzzing performance under a limited *** distribution strategies of American Fuzzy Lop(AFL)based greybox fuzzing focus on increasing coverage blindly without considering the metrics of code regions,thus lacking the insight regarding which region is more likely to be vulnerable and deserves more fuzzing *** tackle the above drawback by proposing a vulnerable region-aware greybox fuzzing ***,we distribute more fuzzing resources towards regions that are more likely to be vulnerable based on four kinds of code *** implemented the approach as an extension to AFL named ***-scale experimental evaluations validate the effectiveness and efficiency of RegionFuzz-11 new bugs including three new CVEs are successfully uncovered by RegionFuzz.

关键词： vulnerability detection greybox fuzzing code metrics resource distribution

A static technique for detecting input validation vulnerabilities in Android apps

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Science China(Information Sciences) 2017年第5期60卷 210-225页

作者： Zhejun FANG Qixu LIU Yuqing ZHANG Kai WANG Zhiqiang WANG Qianru WU National Computer Network Intrusion Protection Center University of Chinese Academy of Sciences National Computer Network Emergency Response Technical Team/Coordination Center of China State Key Laboratory of Information Security Institute of Information EngineeringChinese Academy of Sciences Beijing Electronic Science and Technology Institute

Input validation vulnerabilities are common in Android apps, especially in inter-component communications. Malicious attacks can exploit this kind of vulnerability to bypass Android security mechanism and compromise the integrity, confidentiality and availability of Android devices. However, so far there is not a sound approach at the source code level for app developers aiming to detect input validation vulnerabilities in Android apps. In this paper, we propose a novel approach for detecting input validation flaws in Android apps and we implement a prototype named Easy IVD, which provides practical static analysis of Java source *** IVD leverages backward program slicing to extract transaction and constraint slices from Java source *** Easy IVD validates these slices with predefined security rules to detect vulnerabilities in a known *** detect vulnerabilities in an unknown pattern, Easy IVD extracts implicit security specifications as frequent patterns from the duplicated slices and verifies them. Then Easy IVD semi-automatically confirms the suspicious rule violations and reports the confirmed ones as vulnerabilities. We evaluate Easy IVD on four versions of original Android apps spanning from version 2.2 to 5.0. It detects 58 vulnerabilities including confused deputy attacks and denial of service attacks. Our results prove that Easy IVD can provide a practical defensive solution for app developers.

关键词： input validation static analysis program slicing vulnerability detection Android security