ICSE 2024
Fri 12 - Sun 21 April 2024 Lisbon, Portugal
Wed 17 Apr 2024 11:45 - 12:00 at Grande Auditório - AI & Security 1 Chair(s): Tevfik Bultan

Vulnerability analysis is crucial for software security. Inspired by the success of pre-trained models on software engineering tasks, this work focuses on using pre-training techniques to enhance the understanding of vulnerable code and boost vulnerability analysis. The code understanding ability of a pre-trained model is highly related to its pre-training objectives. The semantic structure, e.g., control and data dependencies, of code is important for vulnerability analysis. However, existing pre-training objectives either ignore such structure or focus on learning to use it. The feasibility and benefits of learning the knowledge of analyzing semantic structure have not been investigated. To this end, this work proposes two novel pre-training objectives, namely Control Dependency Prediction (CDP) and Data Dependency Prediction (DDP), which aim to predict the statement-level control dependencies and token-level data dependencies, respectively, in a code snippet only based on its source code. During pre-training, CDP and DDP can guide the model to learn the knowledge required for analyzing fine-grained dependencies in code. After pre-training, the pre-trained model can boost the understanding of vulnerable code during fine-tuning and can directly be used to perform dependence analysis for both partial and complete functions. To demonstrate the benefits of our pre-training objectives, we pre-train a Transformer model named PDBERT with CDP and DDP, fine-tune it on three vulnerability analysis tasks, i.e., vulnerability detection, vulnerability classification, and vulnerability assessment, and also evaluate it on program dependence analysis. Experimental results show that PDBERT benefits from CDP and DDP, leading to state-of-the-art performance on the three downstream tasks. Also, PDBERT achieves F1-scores of over 99% and 94% for predicting control and data dependencies, respectively, in partial and complete functions.

Wed 17 Apr

Displayed time zone: Lisbon change

11:00 - 12:30
AI & Security 1Research Track / Journal-first Papers at Grande Auditório
Chair(s): Tevfik Bultan University of California at Santa Barbara
11:00
15m
Talk
Towards More Practical Automation of Vulnerability Assessment
Research Track
Shengyi Pan Zhejiang University, Lingfeng Bao Zhejiang University, Jiayuan Zhou Huawei, Xing Hu Zhejiang University, Xin Xia Huawei Technologies, Shanping Li Zhejiang University
11:15
15m
Talk
VGX: Large-Scale Sample Generation for Boosting Learning-Based Software Vulnerability Analyses
Research Track
Yu Nong Washington State University, Richard Fang Washington State University, Guangbei Yi Washington State University, Kunsong Zhao The Hong Kong Polytechnic University, Xiapu Luo The Hong Kong Polytechnic University, Feng Chen University of Texas at Dallas, Haipeng Cai Washington State University
11:30
15m
Talk
MalCertain: Enhancing Deep Neural Network Based Android Malware Detection by Tackling Prediction Uncertainty
Research Track
haodong li Beijing University of Posts and Telecommunications, Guosheng Xu Beijing University of Posts and Telecommunications, Liu Wang Beijing University of Posts and Telecommunications, Xusheng Xiao Arizona State University, Xiapu Luo The Hong Kong Polytechnic University, Guoai Xu Harbin Institute of Technology, Shenzhen, Haoyu Wang Huazhong University of Science and Technology
11:45
15m
Talk
Pre-training by Predicting Program Dependencies for Vulnerability Analysis Tasks
Research Track
Zhongxin Liu Zhejiang University, Zhijie Tang Zhejiang University, Junwei Zhang Zhejiang University, Xin Xia Huawei Technologies, Xiaohu Yang Zhejiang University
12:00
15m
Talk
Investigating White-Box Attacks for On-Device Models
Research Track
Mingyi Zhou Monash University, Xiang Gao Beihang University, Jing Wu Monash University, Kui Liu Huawei, Hailong Sun Beihang University, Li Li Beihang University
12:15
7m
Talk
VulExplainer: A Transformer-Based Hierarchical Distillation for Explaining Vulnerability Types
Journal-first Papers
Michael Fu Monash University, Van Nguyen Monash University, Kla Tantithamthavorn Monash University, Trung Le Monash University, Australia, Dinh Phung Monash University, Australia
Link to publication DOI
12:22
7m
Talk
SIEGE: A Semantics-Guided Safety Enhancement Framework for AI-enabled Cyber-Physical Systems
Journal-first Papers
Jiayang Song University of Alberta, Xuan Xie University of Alberta, Lei Ma The University of Tokyo & University of Alberta
DOI