VDLS: A Vulnerability Detection Approach Based on Execution Path Selection
Vulnerabilities have become one of the most serious threats to software. In order to mitigate the impact of software vulnerabilities, researchers have continuously proposed vulnerability detection approaches. Although these investigations have achieved significant success, there is still room for improvement. Traditional approaches rely on code sequences or code graphs to extract the general characteristics of code, containing excessive information that is irrelevant to vulnerabilities. Meanwhile, traditional single-model approaches are hard to handle the multiangle vulnerability information, lacking the ability to effectively detect vulnerabilities. To address the above two problems, we proposed a new vulnerability detection approach, i.e., VDLS. It first selects the execution paths with the related entities of vulnerabilities from the constructed Control Flow Graph (CFG) of the source code. Then, it combines the code sequence and the execution paths as the intermediate representation, which can capture the features of the source code from the perspectives of structures and semantics. Next, we employ a dual model (TextCNN and Transformer) to learn the local and global features based on the intermediate representation. Finally, we design a fusion method to separately fuse the weights of local and global features, aiming to achieve more accurate vulnerability detection results. To evaluate VDLS, we conducted experiments on two widely used public datasets, including FFMPeg+Qemu and Reveal. The experimental results show that VDLS achieves $0.76% \sim 15.97 %$, $3.07% \sim 53.61 %$ improvement on the FFMPeg + Qemu dataset and $0.61 % \sim 8.46 %$, $2.55 % \sim 39.13 %$ improvement on the Reveal dataset compared to eleven state-of-the-art vulnerability detection approaches in terms of accuracy and F1 score, respectively.
Sat 21 JunDisplayed time zone: Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna change
14:00 - 15:30 | Session8: Software Vulnerability and Security IIIResearch Track / New Idea Track / Tool Demonstration Track at Cosmos 3C Chair(s): Lingfeng Bao Zhejiang University | ||
14:00 15mTalk | VDLS: A Vulnerability Detection Approach Based on Execution Path Selection Research Track Xuanyan Zhu Nanjing University of Aeronautics and Astronautics, Jingxuan Zhang Nanjing University of Aeronautics and Astronautics, Yixuan Tang Nanjing University of Aeronautics and Astronautics, Weiqin Zou Nanjing University of Aeronautics and Astronautics, Jiayi Li Nanjing University of Aeronautics and Astronautics, Han Luo Nanjing University of Aeronautics and Astronautics, Jiaqi Liu National Key Laborarory on Test Physics & Numerical Mathematics | ||
14:15 15mTalk | Exploring Typo Squatting Threats in the Hugging Face Ecosystem Research Track Ningyuan Li Beijing University of Technology, Yanjie Zhao Huazhong University of Science and Technology, Shenao Wang Huazhong University of Science and Technology, Zehao Wu Huazhong University of Science and Technology, Haoyu Wang Huazhong University of Science and Technology | ||
14:30 15mTalk | Unraveling the Characterization and Propagation of Security Vulnerabilities in TensorFlow-based Deep Learning Software Supply Chain Research Track Yiren Zhou Nanjing University of Aeronautics and Astronautics, Lina Gong Nanjing University of Aeronautics and Astronautic, Tiantian Ma Nanjing University of Aeronautics and Astronautics File Attached | ||
14:45 15mTalk | Seeing is (Not) Believing: The Mirage Card Attack Targeting Online Social Networks Research Track Wangchenlu Huang Beijing university of posts and telecommunications, Shenao Wang Huazhong University of Science and Technology, Yanjie Zhao Huazhong University of Science and Technology, Tianxiang Wang China United Network Communications Group Corporation Limited, Yuhao Gao China United Network Communications Group Corporation Limited, Guosheng Xu Beijing University of Posts and Telecommunications, Haoyu Wang Huazhong University of Science and Technology | ||
15:00 10mTalk | ETrace : Event-Driven Vulnerability Detection in Smart Contracts via LLM-Based Trace Analysis New Idea Track Chenyang Peng Xi'an Jiaotong University, Haijun Wang Xi'an Jiaotong University, Yin Wu Xi'an Jiaotong University, Hao Wu Xi'an JiaoTong University, Ming Fan Xi'an Jiaotong University, Yitao Zhao Yunnan Power Grid Co., Ltd, Ting Liu Xi'an Jiaotong University Pre-print | ||
15:10 10mTalk | A Natural Language Guided Adaptive Model-based Testing Tool for Autonomous Driving Tool Demonstration Track | ||
15:20 10mTalk | Software Reuse in the Generative AI Era: From Cargo Cult Towards Systematic PracticesBest New Idea Paper Award New Idea Track |
Cosmos 3C is the third room in the Cosmos 3 wing.
When facing the main Cosmos Hall, access to the Cosmos 3 wing is on the left, close to the stairs. The area is accessed through a large door with the number “3”, which will stay open during the event.