Automated Vulnerability Detection in Source Code Using Deep Learning (discussions) | AISC

Toronto Deep Learning Series, 3 December 2018

Speaker: Alex Hesammohseni & Angshuman Ghosh (Loblaw Digital)

Host: Loblaw Digital
Date: Dec 3rd, 2018

Automated Vulnerability Detection in Source Code Using Deep Representation Learning

Increasing numbers of software vulnerabilities are discovered every year whether they are reported publicly or discovered internally in proprietary code. These vulnerabilities can pose serious risk of exploit and result in system compromise, information leaks, or denial of service. We leveraged the wealth of C and C++ open-source code available to develop a large-scale function-level vulnerability detection system using machine learning. To supplement existing labeled vulnerability datasets, we compiled a vast dataset of millions of open-source functions and labeled it with carefully-selected findings from three different static analyzers that indicate potential exploits. The labeled dataset is available at: this https URL. Using these datasets, we developed a fast and scalable vulnerability detection tool based on deep feature representation learning that directly interprets lexed source code. We evaluated our tool on code from both real software packages and the NIST SATE IV benchmark dataset. Our results demonstrate that deep feature representation learning on source code is a promising approach for automated software vulnerability detection.

[rubiskelter]

15:40 - "you need to be as close to the machine code"

I think this might not be true. You should read "On the Naturalness of Software" . Vulnerabilities rarely are found at the machine code level, as it is too strenuous to find such vulnerabilities. Sure some are, but resources needed are expensive and scarce . This means we have 2 problems at hand to solve, and finding vulnerabilities at programming language level will be a reality as it will be strong code analysis (Which is a more general problem)

Great review by the way.

[ranasarkar]

Kindly say me, How can I setup my working_dir=" " path location?