Abstract
Detecting vulnerabilities in software is crucial for preventing cybersecurity attacks, and current machine learning-based methods rely on large amounts of labeled data to train detection models. On the one hand, a major assumption is that the training and test data follow an identical distribution. However, vulnerabilities in different software projects may exhibit various distributions due to their application scenarios, coding habits, and other factors. On the other hand, when detecting vulnerabilities in new projects, it is time-consuming to retrain and test the models. Especially for new projects being developed, it has few or no instances of vulnerabilities. Therefore, how to leverage previous learning experience to learn new projects faster is important. To address these issues, we propose VulGML, a vulnerability detection approach using graph embedding and meta-learning. The goal is to establish a model with enhanced generalization, so that the model trained on multiple known projects can detect vulnerabilities in new projects. To further illustrate the strong generalization of VulGML, we also choose multiple known vulnerability types to train the meta-learning model and a new vulnerability type for vulnerability detection. Experimental results show that VulGML outperforms the state-of-the-art methods by 6.44–39.61% in detecting new projects, achieves an accuracy higher than 77.80% when detecting vulnerabilities in new vulnerability types, and its modules have greatly improved detection performance, demonstrating that VulGML is potentially valuable in practical usage.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
References
Cao, S., Sun, X., Bo, L., Wei, Y., Li, B.: BGNN4VD: constructing bidirectional graph neural-network for vulnerability detection. Inf. Softw. Technol. 136, 106576 (2021)
Chakraborty, S., Krishna, R., Ding, Y., Ray, B.: Deep learning based vulnerability detection: are we there yet. IEEE Trans. Softw. Eng. (2021)
CVEDetails. https://www.cvedetails.com/
Dey, R., Salem, F.M.: Gate-variants of gated recurrent unit (GRU) neural networks. In: 2017 IEEE 60th International Midwest Symposium on Circuits and Systems (MWSCAS), pp. 1597–1600. IEEE (2017)
Dharma, E.M., Gaol, F.L., Warnars, H., Soewito, B.: The accuracy comparison among word2vec, glove, and fasttext towards convolution neural network (CNN) text classification. J. Theor. Appl. Inf. Technol. 100(2), 31 (2022)
Dowd, M., McDonald, J., Schuh, J.: The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilities. Pearson Education (2006)
Guo, W., Fang, Y., Huang, C., Ou, H., Lin, C., Guo, Y.: HyVulDect: a hybrid semantic vulnerability mining system based on graph neural network. Comput. Secur. 102823 (2022)
Hu, Z., Dong, Y., Wang, K., Chang, K.W., Sun, Y.: GPT-GNN: generative pre-training of graph neural networks. In: Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, pp. 1857–1867 (2020)
Li, X., Xin, Y., Zhu, H., Yang, Y., Chen, Y.: Cross-domain vulnerability detection using graph embedding and domain adaptation. Comput. Secur. 125, 103017 (2023)
Li, Z., Zou, D., Xu, S., Jin, H., Zhu, Y., Chen, Z.: SySeVR: a framework for using deep learning to detect software vulnerabilities. IEEE Trans. Dependable Secure Comput. 19(4), 2244–2258 (2021)
Li, Z., et al.: VulDeePecker: a deep learning-based system for vulnerability detection. arXiv preprint arXiv:1801.01681 (2018)
Liu, S., et al.: CD-VulD: cross-domain vulnerability discovery based on deep domain adaptation. IEEE Trans. Dependable Secure Comput. 19(1), 438–451 (2020)
Mikolov, T., Chen, K., Corrado, G., Dean, J.: Efficient estimation of word representations in vector space. arXiv preprint arXiv:1301.3781 (2013)
Nam, J., Pan, S.J., Kim, S.: Transfer defect learning. In: 2013 35th International Conference on Software Engineering (ICSE), pp. 382–391. IEEE (2013)
Nguyen, V.A., Nguyen, D.Q., Nguyen, V., Le, T., Tran, Q.H., Phung, D.: ReGVD: revisiting graph neural networks for vulnerability detection. In: Proceedings of the ACM/IEEE 44th International Conference on Software Engineering: Companion Proceedings, pp. 178–182 (2022)
Wang, H., et al.: Combining graph-based learning with automated data collection for code vulnerability detection. IEEE Trans. Inf. Forensics Secur. 16, 1943–1958 (2020)
Wartschinski, L., Noller, Y., Vogel, T., Kehrer, T., Grunske, L.: VUDENC: vulnerability detection with deep learning on a natural codebase for Python. Inf. Softw. Technol. 144, 106809 (2022)
Wu, Y., Zou, D., Dou, S., Yang, W., Xu, D., Jin, H.: VulCNN: an image-inspired scalable vulnerability detection system. In: Proceedings of the 44th International Conference on Software Engineering, pp. 2365–2376 (2022)
Xu, Y., et al.: A unified framework for metric transfer learning. IEEE Trans. Knowl. Data Eng. 29(6), 1158–1171 (2017)
Yamaguchi, F., Golde, N., Arp, D., Rieck, K.: Modeling and discovering vulnerabilities with code property graphs. In: 2014 IEEE Symposium on Security and Privacy, pp. 590–604. IEEE (2014)
Zha, D., Lai, K.H., Wan, M., Hu, X.: Meta-AAD: active anomaly detection with deep reinforcement learning. In: 2020 IEEE International Conference on Data Mining (ICDM), pp. 771–780. IEEE (2020)
Zhang, L., et al.: CBGRU: a detection method of smart contract vulnerability based on a hybrid model. Sensors 22(9), 3577 (2022)
Zhou, Y., Liu, S., Siow, J., Du, X., Liu, Y.: Devign: effective vulnerability identification by learning comprehensive program semantics via graph neural networks. In: Advances in Neural Information Processing Systems, vol. 32 (2019)
Acknowledgement
This work is supported by the National Natural Science Foundation of China under Grant 61972392, Grant 62072453 and Grant 62202462.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2024 The Author(s), under exclusive license to Springer Nature Singapore Pte Ltd.
About this paper
Cite this paper
Sun, H., Bu, Z., Xiao, Y., Zhou, C., Hao, Z., Zhu, H. (2024). Software Vulnerability Detection Using an Enhanced Generalization Strategy. In: Hermanns, H., Sun, J., Bu, L. (eds) Dependable Software Engineering. Theories, Tools, and Applications. SETTA 2023. Lecture Notes in Computer Science, vol 14464. Springer, Singapore. https://doi.org/10.1007/978-981-99-8664-4_13
Download citation
DOI: https://doi.org/10.1007/978-981-99-8664-4_13
Published:
Publisher Name: Springer, Singapore
Print ISBN: 978-981-99-8663-7
Online ISBN: 978-981-99-8664-4
eBook Packages: Computer ScienceComputer Science (R0)