Toward More Effective Deep Learning-based Automated Software Vulnerability Prediction, Classification, and Repair
Software vulnerabilities are prevalent in software systems and the unresolved vulnerable code may cause system failures or serious data breaches. To enhance security and prevent potential cyberattacks on software systems, it is critical to (1) early detect vulnerable code, (2) identify its vulnerability type, and (3) suggest corresponding repairs. Recently, deep learning-based approaches have been proposed to predict those tasks based on source code. In particular, software vulnerability prediction (SVP) detects vulnerable source code; software vulnerability classification (SVC) identifies vulnerability types to explain detected vulnerable programs; neural machine translation (NMT)-based automated vulnerability repair (AVR) generates patches to repair detected vulnerable programs. However, existing SVPs require much effort to inspect their coarse-grained predictions; SVCs encounter an unresolved data imbalance issue; AVRs are still inaccurate. I hypothesize that by addressing the limitations of existing SVPs, SVCs and AVRs, we can improve the accuracy and effectiveness of DL-based approaches for the aforementioned three prediction tasks. To test this hypothesis, I will propose (1) a finer-grained SVP approach that can point out vulnerabilities at the line level; (2) an SVC approach that mitigates the data imbalance issue; (3) NMT-based AVR approaches to address limitations of previous NMT-based approaches. Finally, I propose integrating these novel approaches into an open-source software security framework to promote the adoption of the DL-powered security tool in the industry.
Tue 16 MayDisplayed time zone: Hobart change
11:00 - 12:30 | |||
11:00 12mDoctoral symposium paper | Detecting Scattered and Tangled Quality Concerns in Code to Aid Maintenance and Evolution Tasks DS - Doctoral Symposium Rrezarta Krasniqi University of North Carolina at Charlotte | ||
11:12 12mDoctoral symposium paper | Automating Code Review DS - Doctoral Symposium Rosalia Tufano Università della Svizzera Italiana | ||
11:25 12mDoctoral symposium paper | Addressing Performance Regressions in DevOps: Can We Escape from System Performance Testing? DS - Doctoral Symposium Lizhi Liao Concordia University | ||
11:38 12mDoctoral symposium paper | Toward More Effective Deep Learning-based Automated Software Vulnerability Prediction, Classification, and Repair DS - Doctoral Symposium Michael Fu Monash University | ||
11:51 12mDoctoral symposium paper | Enhancing Deep Reinforcement Learning with Executable Specifications DS - Doctoral Symposium Raz Yerushalmi Weizmann | ||
12:04 12mDoctoral symposium paper | Toward Automated Tools to Support Ethical GUI Design DS - Doctoral Symposium S M Hasan Mansur George Mason University | ||
12:17 12mDoctoral symposium paper | Towards strengthening software library interfaces with granular and interactive type migrations DS - Doctoral Symposium Richárd Szalay Eötvös Loránd University, Faculty of Informatics, Department of Programming Languages and Compilers |