VulChecker: Graph-based Vulnerability Localization in Source Code
VulChecker：基于图的源代码漏洞定位

This paper is included in the Proceedings of the 32nd USENIX Security Symposium.
本文收录于第 32 届 USENIX 安全研讨会论文集。

VulChecker: Graph-based Vulnerability Localization in Source Code
VulChecker：基于图的源代码漏洞定位

1 Introduction 1 引言

1.1 Recent Efforts 1.1 最近的努力

1.2 Insights 1.2 见解

1.3 The Proposed Solution
1.3 提出的解决方案

1.4 Contributions 1.4 贡献

• To the best of our knowledge, VulChecker is the first deep learning framework that can both detect vulnerabilities in source code with instruction and line-level precision and classify the type of CWE. This makes VulChecker the first practical deep learning-based SAST tool for developers, enabling them to quickly identify and remediate vulnerabilities in their code in the same manner as traditional SAST tools. Improving upon prior techniques, developers using VulChecker do not need to search hundreds of lines to find vulnerable code and/or determine what type of vulnerability is present.
  据我们所知，VulChecker 是第一个能够以指令和行级精度检测源代码中的漏洞并分类 CWE 类型的深度学习框架。这使得 VulChecker 成为第一个实用的基于深度学习的 SAST 工具，帮助开发者快速识别和修复代码中的漏洞，方式与传统 SAST 工具相同。与之前的技术相比，使用 VulChecker 的开发者无需搜索数百行代码来查找漏洞代码和/或确定存在何种类型的漏洞。
• We introduce the use of message passing neural networks for the task of vulnerability detection to learn and identify the relationship (causality) between a vulnerability’s root cause and manifestation point in a PDG. Using this model, we are also able to explicitly assign features to edges in our ePDG, such as data type in the DFG component.
  我们引入了消息传递神经网络用于漏洞检测任务，以学习和识别漏洞根本原因与表现点在程序依赖图（PDG）中的关系（因果关系）。使用该模型，我们还能够明确地将特征分配给我们的扩展程序依赖图（ePDG）中的边，例如数据流图（DFG）组件中的数据类型。
• We propose the ePDG, a novel graph-based machinelearning optimized program representation that avoids the inefficiencies and drawbacks of others in prior work.
  我们提出了 ePDG，一种新颖的基于图的机器学习优化程序表示，避免了先前工作中其他方法的低效和缺陷。
• We present a novel data augmentation approach that helps mitigate the lack of fine-grained datasets for GNN-based source code vulnerability detection, while still generalizing to real world software projects taken from the wild. The approach is simple and easy to implement, making it a practical way to boost the performance of future models in this research domain.
  我们提出了一种新颖的数据增强方法，旨在缓解基于图神经网络的源代码漏洞检测中细粒度数据集的缺乏，同时仍能推广到来自实际软件项目的真实场景。该方法简单易行，是提升该研究领域未来模型性能的实用方式。

2 Related Works 2 相关工作

source code and contrast them to VulChecker’s model, program representation, and application (summarized in Table 1).
源代码，并将其与 VulChecker 的模型、程序表示和应用进行对比（总结见表 1）。

2.1 Model 2.1 模型

2.2 Program Representation
2.2 程序表示

2.3 Application 2.3 应用

3 VulChecker

1. ePDG Generation: Given a target program’s source code (denoted by $S$$S$SS ), we first compile it to LLVM IR (intermediate representation) and apply several optimizations. Next, we use a custom LLVM plugin specific to the CWE type of interest to analyze the IR, tag potential root cause and manifestation points, and produce an ePDG of $S$$S$SS denoted by $G$$G$GG. This process is detailed in Section 3.1.
   ePDG 生成：给定目标程序的源代码（表示为 $S$$S$SS ），我们首先将其编译为 LLVM IR（中间表示）并应用若干优化。接下来，我们使用一个特定于感兴趣的 CWE 类型的自定义 LLVM 插件来分析 IR，标记潜在的根本原因和表现点，并生成一个表示为 $G$$G$GG 的 $S$$S$SS 的 ePDG。该过程在第 3.1 节中详细说明。
2. Sampling: Next, we scan $G$$G$GG to locate potential manifestation points for the given CWE (Section 3.2) that were tagged during ePDG generation. A manifestation point is any node $m$$m$mm (instruction) in $G$$G$GG that is known to manifest that CWE (e.g., stack memory writes for stack overflow). For the $i$$i$ii-th manifestation point in $G$$G$GG, we cut a subgraph $G_i$$G_i$G_(i)G_{i} backwards from that point up to a given depth. $G_i$$G_i$G_(i)G_{i} represents an observation upon which VulChecker predicts whether or not a vulnerability exists.
   采样：接下来，我们扫描 $G$$G$GG 以定位在 ePDG 生成过程中标记的给定 CWE（第 3.2 节）的潜在表现点。表现点是指在 $G$$G$GG 中已知会表现该 CWE 的任何节点 $m$$m$mm （指令）（例如，堆栈溢出的堆栈内存写入）。对于 $G$$G$GG 中的第 $i$$i$ii 个表现点，我们从该点向后切割一个子图 $G_i$$G_i$G_(i)G_{i} ，直到给定的深度。 $G_i$$G_i$G_(i)G_{i} 表示 VulChecker 预测是否存在漏洞的观察结果。
3. Feature Extraction: Using the same structure of $G_i$$G_i$G_(i)G_{i}, we create an annotated graph $G_i^{\prime }$$G_i^{\prime }$G_(i)^(')G_{i}^{\prime} where each node contains a feature vector that explicitly captures the respective instruction in $G_i$$G_i$G_(i)G_{i}. Similarly, we add explicit features to the edges of $G_i^{\prime }$$G_i^{\prime }$G_(i)^(')G_{i}^{\prime}. Consequently, $G_i^{\prime }$$G_i^{\prime }$G_(i)^(')G_{i}^{\prime} captures the code leading up to the $i$$i$ii-th manifestation point in a manner that a graph-based machine learning model can understand (Section 3.3).
   特征提取：使用 $G_i$$G_i$G_(i)G_{i} 的相同结构，我们创建一个注释图 $G_i^{\prime }$$G_i^{\prime }$G_(i)^(')G_{i}^{\prime} ，其中每个节点包含一个特征向量，明确捕捉 $G_i$$G_i$G_(i)G_{i} 中的相应指令。同样，我们为 $G_i^{\prime }$$G_i^{\prime }$G_(i)^(')G_{i}^{\prime} 的边添加了显式特征。因此， $G_i^{\prime }$$G_i^{\prime }$G_(i)^(')G_{i}^{\prime} 以图形化机器学习模型可以理解的方式捕捉到达第 $i$$i$ii 个表现点之前的代码（第 3.3 节）。
4. Model Training/Execution: VulChecker predicts whether the $i$$i$ii-th manifestation point is vulnerable or not by passing $G_i^{\prime }$$G_i^{\prime }$G_(i)^(')G_{i}^{\prime} through a S2V model $M$$M$MM (Section 3.4). The S2V model is a binary classifier trained on a specific CWE. To train $M$$M$MM, we use many negative samples of $S$$S$SS, where each sample has been augmented with many positive synthetic examples (Section 4).
   模型训练/执行：VulChecker 通过将 $G_i^{\prime }$$G_i^{\prime }$G_(i)^(')G_{i}^{\prime} 传递给 S2V 模型 $M$$M$MM （第 3.4 节）来预测第 $i$$i$ii 个表现点是否脆弱。S2V 模型是一个针对特定 CWE 训练的二元分类器。为了训练 $M$$M$MM ，我们使用了许多 $S$$S$SS 的负样本，每个样本都经过许多正合成示例的增强（第 4 节）。
5. Annotation If $M$$M$MM predicts $G_i^{\prime }$$G_i^{\prime }$G_(i)^(')G_{i}^{\prime} as positive, then the debug symbols passed down from $S$$S$SS to the $i$$i$ii-th manifestation point in the ePDG are used to report line number and instruction to the developer.
   注释 如果 $M$$M$MM 将 $G_i^{\prime }$$G_i^{\prime }$G_(i)^(')G_{i}^{\prime} 预测为正，则从 $S$$S$SS 传递到 ePDG 中第 $i$$i$ii 个表现点的调试符号用于向开发者报告行号和指令。

3.1 ePDG Generation 3.1 ePDG 生成

3.1.1 Lowering Code to LLVM IR
3.1.1 降低代码到 LLVM IR