MVD可跨语言检测漏洞,准确率比现有方法高超83.7%。
MVD: A Multi-Lingual Software Vulnerability Detection Framework
- 融合多语言漏洞数据,统一学习跨语言漏洞模式。
- 在11000+真实漏洞上测试,多语言检测PR-AUC提升83.7%~193.6%。
- 支持增量学习新语言,旧语言性能不降,适合实战部署。
软件漏洞可能引发灾难性网络攻击,严重威胁企业和公共部门。近年来,基于学习的漏洞检测方法兴起,但大多仅针对单一语言(如C/C++),难以应对现代软件项目多语言共存的特点。此外,现有方法未有效利用不同语言间的漏洞知识协同效应。为此,本文提出MVD——一种多语言漏洞检测框架。该框架通过专用数据管道收集多语言漏洞数据,实现多语言并行学习,并引入增量学习机制,使MVD能扩展至新语言而不影响已有语言的检测性能。在包含超过11,000个真实多语言漏洞的数据集上,实验表明其多语言检测的PR-AUC相比最先进方法提升83.7%至193.6%。结果还显示,即使无旧语言训练数据,新语言也能被准确检测,且旧语言性能不受影响。研究为现代软件系统中多语言漏洞预测提供了可行路径。
原文摘要 · Abstract (English)
Software vulnerabilities can result in catastrophic cyberattacks that increasingly threaten business operations. Consequently, ensuring the safety of software systems has become a paramount concern for both private and public sectors. Recent literature has witnessed increasing exploration of learning-based approaches for software vulnerability detection. However, a key limitation of these techniques is their primary focus on a single programming language, such as C/C++, which poses constraints considering the polyglot nature of modern software projects. Further, there appears to be an oversight in harnessing the synergies of vulnerability knowledge across varied languages, potentially underutilizing the full capabilities of these methods. To address the aforementioned issues, we introduce MVD - an innovative multi-lingual vulnerability detection framework. This framework acquires the ability to detect vulnerabilities across multiple languages by concurrently learning from vulnerability data of various languages, which are curated by our specialized pipeline. We also incorporate incremental learning to enable the detection capability of MVD to be extended to new languages, thus augmenting its practical utility. Extensive experiments on our curated dataset of more than 11K real-world multi-lingual vulnerabilities substantiate that our framework significantly surpasses state-of-the-art methods in multi-lingual vulnerability detection by 83.7% to 193.6% in PR-AUC. The results also demonstrate that MVD detects vulnerabilities well for new languages without compromising the detection performance of previously trained languages, even when training data for the older languages is unavailable. Overall, our findings motivate and pave the way for the prediction of multi-lingual vulnerabilities in modern software systems.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。