Conference
On the Effectiveness of Function-Level Vulnerability Detectors for Inter-Procedural Vulnerabilities.
| Τίτλος: | On the Effectiveness of Function-Level Vulnerability Detectors for Inter-Procedural Vulnerabilities. |
|---|---|
| Συγγραφείς: | Li, Zhen, Wang, Ning, Zou, Deqing, Li, Yating, Zhang, Ruqian, Xu, Shouhuai, Zhang, Chao, Jin, Hai |
| Πηγή: | ICSE: International Conference on Software Engineering; 2024, p1-12, 12p |
| Θεματικοί όροι: | Computer security vulnerabilities, Computer crimes, Deep learning, Open source software, C++, Object-oriented programming languages |
| Περίληψη: | Software vulnerabilities are a major cyber threat and it is important to detect them. One important approach to detecting vulnerabilities is to use deep learning while treating a program function as a whole, known as function-level vulnerability detectors. However, the limitation of this approach is not understood. In this paper, we investigate its limitation in detecting one class of vulnerabilities known as inter-procedural vulnerabilities, where the to-be-patched statements and the vulnerability-triggering statements belong to different functions. For this purpose, we create the first Inter-Procedural Vulnerability Dataset (InterPVD) based on C/C++ open-source software, and we propose a tool dubbed VulTrigger for identifying vulnerability-triggering statements across functions. Experimental results show that VulTrigger can effectively identify vulnerability-triggering statements and inter-procedural vulnerabilities. Our findings include: (i) inter-procedural vulnerabilities are prevalent with an average of 2.8 inter-procedural layers; and (ii) function-level vulnerability detectors are much less effective in detecting to-be-patched functions of inter-procedural vulnerabilities than detecting their counterparts of intra-procedural vulnerabilities. [ABSTRACT FROM AUTHOR] |
| Copyright of ICSE: International Conference on Software Engineering is the property of Association for Computing Machinery and its content may not be copied or emailed to multiple sites without the copyright holder's express written permission. Additionally, content may not be used with any artificial intelligence tools or machine learning technologies. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.) | |
| Βάση Δεδομένων: | Complementary Index |
| FullText | Text: Availability: 0 |
|---|---|
| Header | DbId: edb DbLabel: Complementary Index An: 185196498 RelevancyScore: 973 AccessLevel: 6 PubType: Conference PubTypeId: conference PreciseRelevancyScore: 972.830749511719 |
| IllustrationInfo | |
| Items | – Name: Title Label: Title Group: Ti Data: On the Effectiveness of Function-Level Vulnerability Detectors for Inter-Procedural Vulnerabilities. – Name: Author Label: Authors Group: Au Data: <searchLink fieldCode="AR" term="%22Li%2C+Zhen%22">Li, Zhen</searchLink><br /><searchLink fieldCode="AR" term="%22Wang%2C+Ning%22">Wang, Ning</searchLink><br /><searchLink fieldCode="AR" term="%22Zou%2C+Deqing%22">Zou, Deqing</searchLink><br /><searchLink fieldCode="AR" term="%22Li%2C+Yating%22">Li, Yating</searchLink><br /><searchLink fieldCode="AR" term="%22Zhang%2C+Ruqian%22">Zhang, Ruqian</searchLink><br /><searchLink fieldCode="AR" term="%22Xu%2C+Shouhuai%22">Xu, Shouhuai</searchLink><br /><searchLink fieldCode="AR" term="%22Zhang%2C+Chao%22">Zhang, Chao</searchLink><br /><searchLink fieldCode="AR" term="%22Jin%2C+Hai%22">Jin, Hai</searchLink> – Name: TitleSource Label: Source Group: Src Data: ICSE: International Conference on Software Engineering; 2024, p1-12, 12p – Name: Subject Label: Subject Terms Group: Su Data: <searchLink fieldCode="DE" term="%22Computer+security+vulnerabilities%22">Computer security vulnerabilities</searchLink><br /><searchLink fieldCode="DE" term="%22Computer+crimes%22">Computer crimes</searchLink><br /><searchLink fieldCode="DE" term="%22Deep+learning%22">Deep learning</searchLink><br /><searchLink fieldCode="DE" term="%22Open+source+software%22">Open source software</searchLink><br /><searchLink fieldCode="DE" term="%22C%2B%2B%22">C++</searchLink><br /><searchLink fieldCode="DE" term="%22Object-oriented+programming+languages%22">Object-oriented programming languages</searchLink> – Name: Abstract Label: Abstract Group: Ab Data: Software vulnerabilities are a major cyber threat and it is important to detect them. One important approach to detecting vulnerabilities is to use deep learning while treating a program function as a whole, known as function-level vulnerability detectors. However, the limitation of this approach is not understood. In this paper, we investigate its limitation in detecting one class of vulnerabilities known as inter-procedural vulnerabilities, where the to-be-patched statements and the vulnerability-triggering statements belong to different functions. For this purpose, we create the first Inter-Procedural Vulnerability Dataset (InterPVD) based on C/C++ open-source software, and we propose a tool dubbed VulTrigger for identifying vulnerability-triggering statements across functions. Experimental results show that VulTrigger can effectively identify vulnerability-triggering statements and inter-procedural vulnerabilities. Our findings include: (i) inter-procedural vulnerabilities are prevalent with an average of 2.8 inter-procedural layers; and (ii) function-level vulnerability detectors are much less effective in detecting to-be-patched functions of inter-procedural vulnerabilities than detecting their counterparts of intra-procedural vulnerabilities. [ABSTRACT FROM AUTHOR] – Name: Abstract Label: Group: Ab Data: <i>Copyright of ICSE: International Conference on Software Engineering is the property of Association for Computing Machinery and its content may not be copied or emailed to multiple sites without the copyright holder's express written permission. Additionally, content may not be used with any artificial intelligence tools or machine learning technologies. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract.</i> (Copyright applies to all Abstracts.) |
| PLink | https://search.ebscohost.com/login.aspx?direct=true&site=eds-live&db=edb&AN=185196498 |
| RecordInfo | BibRecord: BibEntity: Identifiers: – Type: doi Value: 10.1145/3597503.3639218 Languages: – Code: eng Text: English PhysicalDescription: Pagination: PageCount: 12 StartPage: 1 Subjects: – SubjectFull: Computer security vulnerabilities Type: general – SubjectFull: Computer crimes Type: general – SubjectFull: Deep learning Type: general – SubjectFull: Open source software Type: general – SubjectFull: C++ Type: general – SubjectFull: Object-oriented programming languages Type: general Titles: – TitleFull: On the Effectiveness of Function-Level Vulnerability Detectors for Inter-Procedural Vulnerabilities. Type: main BibRelationships: HasContributorRelationships: – PersonEntity: Name: NameFull: Li, Zhen – PersonEntity: Name: NameFull: Wang, Ning – PersonEntity: Name: NameFull: Zou, Deqing – PersonEntity: Name: NameFull: Li, Yating – PersonEntity: Name: NameFull: Zhang, Ruqian – PersonEntity: Name: NameFull: Xu, Shouhuai – PersonEntity: Name: NameFull: Zhang, Chao – PersonEntity: Name: NameFull: Jin, Hai IsPartOfRelationships: – BibEntity: Dates: – D: 01 M: 05 Text: 2024 Type: published Y: 2024 Titles: – TitleFull: ICSE: International Conference on Software Engineering Type: main |
| ResultId | 1 |