首页|Graph neural network based approach to automatically assigning common weakness enumeration identifiers for vulnerabilities

Graph neural network based approach to automatically assigning common weakness enumeration identifiers for vulnerabilities

扫码查看
原文链接
  • NETL
  • NSTL
  • 万方数据
Vulnerability reports are essential for improving software security since they record key information on vulnerabilities.In a report,CWE denotes the weakness of the vulnerability and thus helps quickly understand the cause of the vulner-ability.Therefore,CWE assignment is useful for categorizing newly discovered vulnerabilities.In this paper,we propose an automatic CWE assignment method with graph neural networks.First,we prepare a dataset that contains 3394 real world vulnerabilities from Linux,OpenSSL,Wireshark and many other software programs.Then,we extract state-ments with vulnerability syntax features from these vulnerabilities and use program slicing to slice them according to the categories of syntax features.On top of slices,we represent these slices with graphs that characterize the data dependency and control dependency between statements.Finally,we employ the graph neural networks to learn the hidden information from these graphs and leverage the Siamese network to compute the similarity between vulnerability functions,thereby assigning CWE IDs for these vulnerabilities.The experimental results show that the proposed method is effective compared to existing methods.

Vulnerability categorizationCWEGraph representationGNN

Peng Liu、Wenzhe Ye、Haiying Duan、Xianxian Li、Shuyi Zhang、Chuanjian Yao、Yongnan Li

展开 >

Key Lab of Education Blockchain and Intelligent Technology,Ministry of Education,Guangxi Normal University,Guilin 541004,China

Guangxi Key Lab of Multi-Source Information Mining and Security,Guangxi Normal University,Guilin 541004,China

School of Software,Beihang University,Beijing 100000,China

School of National Security,People's Public Security University of China,Beijing 1000000,China

展开 >

National Natural Science Foundation of ChinaNational Natural Science Foundation of ChinaGuangxi Science and Technology Major ProjectGuangxi Natural Science FoundationCenter for Applied Mathematics of GuangxiGuangxi"Bagui Scholar"Teams for Innovation and Research ProjectGuangxi Talent Highland Project of Big Data Intelligence and ApplicationGuangxi Collaborative Center of Multisource Information Integration and Intelligent ProcessingFundamental Research Funds for the Central Universities

62166004U21A20474AA220680702020GXNSFAA2970752021JKF06

2024

10.1186/s42400-023-00160-1

网络空间安全科学与技术(英文版)

网络空间安全科学与技术(英文版)

EI
ISSN：
年,卷(期)：2024.7(3)