用Transformer分析代码上下文，高效精准识别漏洞
Efficient Software Vulnerability Detection Using Transformer-based Models
- 以程序切片为输入，利用Transformer捕捉代码的局部与全局上下文
- 在多个数据集上实现高准确率，训练耗时和资源消耗较低
- 适合需要快速部署的漏洞检测系统，尤其对嵌入式场景友好
软件漏洞检测对保障现代计算机系统的安全与可靠性至关重要。深度神经网络在漏洞检测中表现良好，但难以捕捉漏洞代码的全局上下文信息。为此，本文探索将Transformer应用于C/C++代码漏洞检测。通过使用包含关键语法与语义特征（如API调用、数组使用、指针操作和算术表达式）的程序切片作为输入，利用Transformer同时建模局部与全局上下文，显著提升漏洞识别能力。结合数据平衡与超参数调优，该方法在中等资源消耗和较短训练时间内实现了高效且稳健的漏洞检测性能。
原文摘要 · Abstract (English)
Detecting software vulnerabilities is critical to ensuring the security and reliability of modern computer systems. Deep neural networks have shown promising results on vulnerability detection, but they lack the capability to capture global contextual information on vulnerable code. To address this limitation, we explore the application of transformers for C/C++ vulnerability detection. We use program slices that encapsulate key syntactic and semantic features of program code, such as API function calls, array usage, pointer manipulations, and arithmetic expressions. By leveraging transformers' capability to capture both local and global contextual information on vulnerable code, our work can identify vulnerabilities accurately. Combined with data balancing and hyperparameter fine-tuning, our work offers a robust and efficient approach to identifying vulnerable code with moderate resource usage and training time.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。