区分真实密钥与占位符，提升代码库漏洞检测准确率
Separating Secrets from Placeholders: A Hybrid CNN-CodeBERT Framework for Three-Class Credential Leakage Detection
- 用语义+字符双重识别，将占位符单独分类
- 真实密钥检出率达93%，误报减少33%
- 跨语言通用性强，10种语言均表现良好
公共代码仓库中的凭证泄露构成严重安全威胁，2024年仅一年就暴露超2380万条敏感信息。现有工具因模式匹配僵化、二分类策略无法区分真实凭证与占位符或弱凭证，导致误报率高。本文提出一种三分类框架，显式将占位符或弱凭证设为独立类别，结合CodeBERT的语义理解与字符级模式识别。在涵盖10种编程语言的9,426样本新数据集上评估，模型取得0.86的马修斯相关系数和0.90的宏平均F1分数，真实凭证泄露检出率达93%，精确率为89%，高危告警减少33.0%（从373降至250），且不降低安全覆盖率。相比以往字符级方法，占位符/弱凭证检测F1从54%提升至81%，在留一语言测试中，10种语言中有9种达到F1 > 0.80，表现出强跨语言泛化能力。
原文摘要 · Abstract (English)
Credential leakage in public source code repositories poses a critical security threat, with over 23.8 million secrets exposed in 2024 alone. Existing detection tools suffer from high false-positive rates because rigid pattern matching and binary classification schemes fail to distinguish genuine credentials from placeholder or weak credentials. We propose a three-class classification framework that explicitly models placeholder or weak credentials as a distinct class, leveraging CodeBERT-based semantic understanding combined with character-level pattern recognition. We evaluate our approach on a newly constructed dataset of 9,426 samples spanning 10 programming languages. Our model achieves a Matthews Correlation Coefficient of 0.86 and a macro F1-score of 0.90, achieving 93% recall and 89% precision for genuine credential leaks while reducing high severity alerts by 33.0% (from 373 to 250) without sacrificing security coverage. Compared to prior character-level approaches, our method improves placeholder or weak credential detection from 54% to 81% F1-score while maintaining strong cross language generalization, with 9 of 10 languages achieving F1 above 0.80 under leave-one-language-out evaluation.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。