在Java源代码中使用量子卷积神经网络进行漏洞检测,具有自我注意的聚合,深度序列和基于图的混合特征提取
Shumaila Hussain1,2, Muhammad Nadeem3, Junaid Baber4,5
1Department of Computer Science, Sardar Bahadur Khan Women's University, Quetta, Pakistan. shumaila.hussain@sbkwu.edu.pk.
Scientific reports
|March 29, 2024
概括
本研究介绍了用于自动检测Java代码漏洞的深度学习系统. 它通过增强语义理解和解决常见的检测挑战来实现99.2%的准确性.
科学领域:
- 计算机科学 计算机科学
- 软件工程 软件工程 软件工程
- 网络安全 网络安全
背景情况:
- 软件漏洞是一个主要的安全风险,需要先进的检测方法.
- 现有的技术在依赖性问题,语言偏差和检测细节性方面扎.
- 在Java代码中自动检测漏洞仍然是一个关键的研究领域.
研究的目的:
- 开发一种新的深度学习系统,用于准确地自动检测Java代码中的漏洞.
- 克服当前方法的局限性,包括依赖性问题和粗细粒度.
- 增强对代码的语义和语法理解,以改善漏洞识别.
主要方法:
- 利用混合特征提取,结合图 (控制流图,抽象语法树,程序依赖) 和基于序列的技术.
- 采用混合神经网络 (GCN-RFEMLP) 和CodeBERT进行特征提取,输入到具有自我注意聚合的量子卷积神经网络中.
- 解决了使用中间代码表示和程序间切片代码的长期依赖性和细分性问题,通过基准数据集缓解语言偏差.
主要成果:
- 在检测软件漏洞方面达到99.2%的卓越准确度.
- 在漏洞检测任务中表现优于现有的基准方法.
- 成功识别了广泛的常见缺陷列表 (CWE) 漏洞,包括不当的输入验证,缓冲区溢出和SQL注入.
结论:
- 拟议的深度学习系统提供了一个高度准确和有效的解决方案,用于自动检测Java代码漏洞.
- 混合特征提取和先进的神经网络架构成功地解决了该领域的关键挑战.
- 这种方法显著提升了软件安全和漏洞分析的最新技术.
相关概念视频
00:56Extraction: Advanced Methods
446
Metal ions can be separated from one another by complexation with organic ligands–the chelating agent– to form uncharged chelates. Here, the chelating agent must contain hydrophobic groups and behave as a weak acid, losing a proton to bind with the metal. Since most organic ligands used in this process are insoluble or undergo oxidation in the aqueous phase, the chelating agent is initially added to the organic phase and extracted into the aqueous phase. The metal-ligand complex is...
446
01:00Detection of Gross Error: The Q Test
6.1K
When one or more data points appear far from the rest of the data, there is a need to determine whether they are outliers and whether they should be eliminated from the data set to ensure an accurate representation of the measured value. In many cases, outliers arise from gross errors (or human errors) and do not accurately reflect the underlying phenomenon. In some cases, however, these apparent outliers reflect true phenomenological differences. In these cases, we can use statistical methods...
6.1K
01:24Convolution: Math, Graphics, and Discrete Signals
250
In any LTI (Linear Time-Invariant) system, the convolution of two signals is denoted using a convolution operator, assuming all initial conditions are zero. The convolution integral can be divided into two parts: the zero-input or natural response and the zero-state or forced response, with t0 indicating the initial time.
To simplify the convolution integral, it is assumed that both the input signal and impulse response are zero for negative time values. The graphical convolution process...
To simplify the convolution integral, it is assumed that both the input signal and impulse response are zero for negative time values. The graphical convolution process...
250
01:30Classification of Signals
456
In signal processing, signals are classified based on various characteristics: continuous-time versus discrete-time, periodic versus aperiodic, analog versus digital, and causal versus noncausal. Each category highlights distinct properties crucial for understanding and manipulating signals.
A continuous-time signal holds a value at every instant in time, representing information seamlessly. In contrast, a discrete-time signal holds values only at specific moments, often denoted as x(n), where...
A continuous-time signal holds a value at every instant in time, representing information seamlessly. In contrast, a discrete-time signal holds values only at specific moments, often denoted as x(n), where...
456