scholarly journals Modeling and Discovering Vulnerabilities with Code Property Graphs

2014 ◽  
Author(s):  
Fabian Yamaguchi ◽  
Nico Golde ◽  
Daniel Arp ◽  
Konrad Rieck
Keyword(s):  
Code Property

scholarly journals BOND-FREE LANGUAGES: FORMALIZATIONS, MAXIMALITY AND CONSTRUCTION METHODS

2005 ◽  
Vol 16 (05) ◽  
pp. 1039-1070 ◽  
Author(s):  
LILA KARI ◽  
STAVROS KONSTANTINIDIS ◽  
PETR SOSÍK
Keyword(s):  
Polynomial Time ◽  
Structural Characterization ◽  
Regular Languages ◽  
Important Case ◽  
Similarity Relation ◽  
Construction Methods ◽  
Large Sets ◽  
Code Property ◽  
Context Free

The problem of negative design of DNA languages is addressed, that is, properties and construction methods of large sets of words that prevent undesired bonds when used in DNA computations. We recall a few existing formalizations of the problem and then define the property of sim-bond-freedom, where sim is a similarity relation between words. We show that this property is decidable for context-free languages and polynomial-time decidable for regular languages. The maximality of this property also turns out to be decidable for regular languages and polynomial-time decidable for an important case of the Hamming similarity. Then we consider various construction methods for Hamming bond-free languages, including the recently introduced method of templates, and obtain a complete structural characterization of all maximal Hamming bond-free languages. This result is applicable to the θ-k-code property introduced by Jonoska and Mahalingam.

scholarly journals Assisting in Auditing of Buffer Overflow Vulnerabilities via Machine Learning

2017 ◽  
Vol 2017 ◽  
pp. 1-13 ◽  
Author(s):  
Qingkun Meng ◽  
Chao Feng ◽  
Bin Zhang ◽  
Chaojing Tang
Keyword(s):  
Machine Learning ◽  
Machine Learning Algorithms ◽  
Buffer Overflow ◽  
Analysis Method ◽  
True Negative ◽  
True Negative Rate ◽  
Negative Rate ◽  
Training Samples ◽  
Extended Code ◽  
Code Property

Buffer overflow vulnerability is a kind of consequence in which programmers’ intentions are not implemented correctly. In this paper, a static analysis method based on machine learning is proposed to assist in auditing buffer overflow vulnerabilities. First, an extended code property graph is constructed from the source code to extract seven kinds of static attributes, which are used to describe buffer properties. After embedding these attributes into a vector space, five frequently used machine learning algorithms are employed to classify the functions into suspicious vulnerable functions and secure ones. The five classifiers reached an average recall of 83.5%, average true negative rate of 85.9%, a best recall of 96.6%, and a best true negative rate of 91.4%. Due to the imbalance of the training samples, the average precision of the classifiers is 68.9% and the average F1 score is 75.2%. When the classifiers were applied to a new program, our method could reduce the false positive to 1/12 compared to Flawfinder.

scholarly journals VulSniper: Focus Your Attention to Shoot Fine-Grained Vulnerabilities

2019 ◽  
Author(s):  
Xu Duan ◽  
Jingzheng Wu ◽  
Shouling Ji ◽  
Zhiqing Rui ◽  
Tianyue Luo ◽  
...  
Keyword(s):  
Computer Security ◽  
Detection Accuracy ◽  
Semantic Features ◽  
Vulnerability Detection ◽  
Accurate Identification ◽  
Fine Grained ◽  
Graph Design ◽  
Benchmark Datasets ◽  
Code Property ◽  
Similar Code

With the explosive development of information technology, vulnerabilities have become one of the major threats to computer security. Most vulnerabilities with similar patterns can be detected effectively by static analysis methods. However, some vulnerable and non-vulnerable code is hardly distinguishable, resulting in low detection accuracy. In this paper, we define the accurate identification of vulnerabilities in similar code as a fine-grained vulnerability detection problem. We propose VulSniper which is designed to detect fine-grained vulnerabilities more effectively. In VulSniper, attention mechanism is used to capture the critical features of the vulnerabilities. Especially, we use bottom-up and top-down structures to learn the attention weights of different areas of the program. Moreover, in order to fully extract the semantic features of the program, we generate the code property graph, design a 144-dimensional vector to describe the relation between the nodes, and finally encode the program as a feature tensor. VulSniper achieves F1-scores of 80.6% and 73.3% on the two benchmark datasets, the SARD Buffer Error dataset and the SARD Resource Management Error dataset respectively, which are significantly higher than those of the state-of-the-art methods.

Code Property Graph-Based Vulnerability Dataset Generation for Source Code Detection

2020 ◽  
pp. 584-591
Author(s):  
Zhibin Guan ◽  
Xiaomeng Wang ◽  
Wei Xin ◽  
Jiajie Wang
Keyword(s):  
Source Code ◽  
Code Property

FORMAL DESCRIPTIONS OF CODE PROPERTIES: DECIDABILITY, COMPLEXITY, IMPLEMENTATION

2012 ◽  
Vol 23 (01) ◽  
pp. 67-85 ◽  
Author(s):  
KRYSTIAN DUDZINSKI ◽  
STAVROS KONSTANTINIDIS
Keyword(s):  
Formal Methods ◽  
Coding Theory ◽  
Regular Language ◽  
Formal Method ◽  
Formal Languages ◽  
Decision Procedures ◽  
Regular Languages ◽  
Formal Expression ◽  
Initial Implementation ◽  
Code Property

The branch of coding theory that is based on formal languages has produced several methods for defining code properties, including word relations, dependence systems, implicational conditions, trajectories, and language inequations. Of those, the latter three can be viewed as formal methods in the sense that a certain formal expression can be used to denote a code property. Here we present a formal method which is based on transducers. Each transducer of a certain type defines/describes a desired code property. The method provides simple and uniform decision procedures for the basic questions of property satisfaction and maximality for regular languages. Our work includes statements about the hardness of deciding some of the problems involved. It turns out that maximality can be hard to decide even for "classical" code properties of finite languages. We also present an initial implementation of a LAnguage SERver capable of deciding the satisfaction problem for a given transducer code property and regular language.

CPGVA: Code Property Graph based Vulnerability Analysis by Deep Learning

2018 ◽  
Author(s):  
Wang Xiaomeng ◽  
Zhang Tao ◽  
Wu Runpu ◽  
Xin Wei ◽  
Hou Changyu
Keyword(s):  
Deep Learning ◽  
Vulnerability Analysis ◽  
Code Property
Sign in / Sign up

Export Citation Format

Share Document