Combining Structured Static Code Information and Dynamic Symbolic Traces for Software Vulnerability Prediction
Deep learning (DL) has emerged as a viable means for identifying software bugs and vulnerabilities. The success of DL relies on having a suitable representation of the problem domain. However, existing DL-based solutions for learning program representations have limitations – they either cannot capture the deep, precise program semantics or suffer from poor scalability. We present Concoction, the first DL system to learn program presentations by combining static source code information and dynamic program execution traces. Concoction employs unsupervised active learning techniques to determine a subset of important paths to collect dynamic symbolic execution traces. By implementing a focused symbolic execution solution, Concoction brings the benefits of static and dynamic code features while reducing the expensive symbolic execution overhead. We integrate Concoction with fuzzing techniques to detect function-level code vulnerabilities in C programs from 20 open-source projects. In 200 hours of automated concurrent test runs, Concoction has successfully uncovered vulnerabilities in all tested projects, identifying 54 unique vulnerabilities and yielding 37 new, unique CVE IDs. Concoction also significantly outperforms 16 prior methods by providing higher accuracy and lower false positive rates.
Fri 19 AprDisplayed time zone: Lisbon change
14:00 - 15:30 | Vulnerability DetectionResearch Track at Eugénio de Andrade Chair(s): Caroline Lemieux University of British Columbia | ||
14:00 15mTalk | GPTScan: Detecting Logic Vulnerabilities in Smart Contracts by Combining GPT with Program Analysis Research Track Yuqiang Sun Nanyang Technological University, Daoyuan Wu Nanyang Technological University, Yue Xue MetaTrust Labs, Han Liu East China Normal University, Haijun Wang Xi'an Jiaotong University, Zhengzi Xu Nanyang Technological University, Xiaofei Xie Singapore Management University, Yang Liu Nanyang Technological University DOI Pre-print | ||
14:15 15mTalk | PrettySmart: Detecting Permission Re-delegation Vulnerability for Token Behaviors in Smart Contracts Research Track Zhijie Zhong School of Software Engineering, Sun Yat-sen University, Hong-Ning Dai Hong Kong Baptist University, Zibin Zheng Sun Yat-sen University, Qing Xue Sun Yat-sen University, Junjia Chen Sun Yat-sen University, Yuhong Nan Sun Yat-sen University | ||
14:30 15mTalk | Combining Structured Static Code Information and Dynamic Symbolic Traces for Software Vulnerability Prediction Research Track Huanting Wang University of Leeds, UK, Zhanyong Tang Northwest University, Shin Hwei Tan Concordia University, Jie Wang NorthWest University, Yuzhe Liu NorthWest University, Hejun Fang NorthWest University, Chunwei Xia University of Leeds, Zheng Wang University of Leeds | ||
14:45 15mTalk | SCVHunter: Smart Contract Vulnerability Detection Based on Heterogeneous Graph Attention Network Research Track Feng Luo University of Electronic Science and Technology of China, Ruijie Luo University of Electronic Science and Technology of China, Ting Chen University of Electronic Science and Technology of China, Ao Qiao University of Electronic Science and Technology of China, Zheyuan He University of Electronic Science and Technology of China, Shuwei Song University of Electronic Science and Technology of China, Yu Jiang Tsinghua university, Sixing Li University of Electronic Science and Technology of China | ||
15:00 15mTalk | PS3: Precise Patch Presence Test based on Semantic Symbolic Signature Research Track Qi Zhan Zhejiang University, Xing Hu Zhejiang University, Zhiyang Li Zhejiang University, Xin Xia Huawei Technologies, David Lo Singapore Management University, Shanping Li Zhejiang University | ||
15:15 15mTalk | Safeguarding DeFi Smart Contracts against Oracle Deviations Research Track Xun Deng University of Toronto, Sidi Mohamed Beillahi University of Toronto, Cyrus Minwalla Bank of Canada, Han Du Bank of Canada, Andreas Veneris University of Toronto, Fan Long University of Toronto |