用Transformer和静态分析检测Java代码中的敏感信息泄露漏洞。
SIExVulTS: Sensitive Information Exposure Vulnerability Detection System using Transformer Models and Static Analysis
- 结合语义嵌入与CodeQL查询，定位敏感数据源头和接收点。
- 流验证阶段将准确率从22.61%提升至87.23%。
- 发现6个未公开的Apache项目漏洞，适合安全工具开发者使用。
敏感信息暴露（SIEx）漏洞（CWE-200）在软件系统中持续存在且难以应对，常引发严重安全事件。现有检测工具很少针对CWE-200的多种子类别，也缺乏对代码级数据流的上下文感知分析。本文提出SIExVulTS，一种融合Transformer模型与静态分析的漏洞检测系统，用于识别和验证Java应用中的敏感信息暴露。该系统采用三阶段架构：(1) 攻击面检测引擎利用句子嵌入识别敏感变量、字符串、注释和接收端；(2) 暴露分析引擎执行与CWE-200层级匹配的CodeQL查询；(3) 流验证引擎借助GraphCodeBERT语义验证源到汇的数据流。我们在三个精心构建的数据集上评估：真实世界CVE、合成的CWE-200示例基准集，以及31个开源项目的标注数据流。结果表明，攻击面检测引擎平均F1分数超过93%，暴露分析引擎达到85.71%的F1分数，流验证引擎使精度从22.61%提升至87.23%。此外，SIExVulTS成功发现6个此前未知的Apache项目CVE。结论表明，SIExVulTS在应对敏感数据泄露方面高效实用，弥补了现有工具在检测与验证CWE-200漏洞方面的不足。
原文摘要 · Abstract (English)
Sensitive Information Exposure (SIEx) vulnerabilities (CWE-200) remain a persistent and under-addressed threat across software systems, often leading to serious security breaches. Existing detection tools rarely target the diverse subcategories of CWE-200 or provide context-aware analysis of code-level data flows. Aims: This paper aims to present SIExVulTS, a novel vulnerability detection system that integrates transformer-based models with static analysis to identify and verify sensitive information exposure in Java applications. Method: SIExVulTS employs a three-stage architecture: (1) an Attack Surface Detection Engine that uses sentence embeddings to identify sensitive variables, strings, comments, and sinks; (2) an Exposure Analysis Engine that instantiates CodeQL queries aligned with the CWE-200 hierarchy; and (3) a Flow Verification Engine that leverages GraphCodeBERT to semantically validate source-to-sink flows. We evaluate SIExVulTS using three curated datasets, including real-world CVEs, a benchmark set of synthetic CWE-200 examples, and labeled flows from 31 open-source projects. Results: The Attack Surface Detection Engine achieved an average F1 score greater than 93\%, the Exposure Analysis Engine achieved an F1 score of 85.71\%, and the Flow Verification Engine increased precision from 22.61\% to 87.23\%. Moreover, SIExVulTS successfully uncovered six previously unknown CVEs in major Apache projects. Conclusions: The results demonstrate that SIExVulTS is effective and practical for improving software security against sensitive data exposure, addressing limitations of existing tools in detecting and verifying CWE-200 vulnerabilities.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。