1 of 80

Machine Learning for Automated Vulnerability Detection in Source Code

Bug name: Junfan Huang

2 of 80

Context

  • Introduction and code representation
  • Inductive logic programming (ILP)
  • Neural Network
  • Results, evaluation/comparison, future work

​

3 of 80

Context

  • Introduction and code representation
  • Inductive logic programming (ILP)
  • Neural Network
  • Results, evaluation/comparison, future work

​

4 of 80

Introduction

  • What we did?
  • Why we did that?
  • How we did that?

​

5 of 80

6 of 80

7 of 80

Dataset

Code Representation

Machine Learning methods

Results

8 of 80

Dataset

Code Representation

Machine Learning methods

Results

9 of 80

Dataset

Code Representation

Machine Learning methods

Results

10 of 80

Dataset

Code Representation

ILP

Results

11 of 80

Dataset

Code Representation

Neural Network

Results

12 of 80

Dataset

Code Representation

Machine Learning methods

Results

13 of 80

Dataset

Juliet dataset[1]

118 different bugs

C/C++

65,000 samples

14 of 80

15 of 80

Dataset

Juliet dataset

Buffer overflow

C/C++

20,000 samples

16 of 80

Dataset

Buffer overflow

Good example

17 of 80

Dataset

Buffer overflows

Good examples

ID:1

ID:2

…

ID:n

18 of 80

Codes

19 of 80

Codes

Code representation

20 of 80

Codes

Code representation

21 of 80

Codes

Code representation

Representation

the way that someone or something is shown or described

22 of 80

Codes

Code representation

the way that code is shown or described

23 of 80

Codes

Code representation

24 of 80

Codes

Code representation

25 of 80

Codes

Code representation

26 of 80

Codes

Code representation

27 of 80

Codes

Code representation

28 of 80

Code representation

29 of 80

Code representation

Abstract Syntax Tree

(AST)

30 of 80

Code representation

Abstract Syntax Tree

(AST)

2+(0-1*9)

31 of 80

Code representation

Abstract Syntax Tree

(AST)

2+(0-1*9)

+

32 of 80

Code representation

Abstract Syntax Tree

(AST)

2

+

2+(0-1*9)

33 of 80

Code representation

Abstract Syntax Tree

(AST)

0-1*9

-

0

34 of 80

Code representation

Abstract Syntax Tree

(AST)

1*9

*

1

9

35 of 80

Code representation

Abstract Syntax Tree

(AST)

0-1*9

-

0

36 of 80

Code representation

Abstract Syntax Tree

(AST)

0-1*9

-

0

*

9

9

*

1

9

37 of 80

Code representation

Abstract Syntax Tree

(AST)

2+(0-1*9)

2

+

38 of 80

Code representation

Abstract Syntax Tree

(AST)

2+(0-1*9)

2

+

-

0

*

9

9

*

1

9

39 of 80

Code representation

Abstract Syntax Tree

(AST)

40 of 80

Code representation

Abstract Syntax Tree

(AST)

41 of 80

Code representation

Abstract Syntax Tree(AST)

Code Property Graph(CPG)

42 of 80

Codes

AST

43 of 80

Codes

AST

44 of 80

  • Abstract syntax tree:
  • Abstract is that we’re not going to express the exact code you’ve typed, instead we are going to make a high level representation of it.
  • The syntax of something is the structure of statements. 

​

  • A tree structure to represent the source code
  • Retain the structure and remove details

About AST

45 of 80

Clang

46 of 80

Bad example

47 of 80

Good example

48 of 80

49 of 80

Two ways

?

50 of 80

Vectorisation

51 of 80

52 of 80

AST

Vector

….

128 dimensions

Graph2vec

53 of 80

Vectors

….

….

….

….

54 of 80

About AST

55 of 80

AST

Adjacency matrix

56 of 80

Bad example

Good example

57 of 80

Bad example

Good example

https://nbviewer.jupyter.org/github/dj311/uob-summer-project/blob/master/code/ML-adj-feature-matrix-conv-neural-network.ipynb#Model

58 of 80

Bad example

59 of 80

Buffer overflow

60 of 80

61 of 80

62 of 80

To find vulnerability and explain it,

more information might be helpful

  • Code statements
  • The order of statements
  • How do statements affect each other

63 of 80

AST

Control Flow Graph

(CFG)

Program Dependence Graph

(PDG)

64 of 80

AST

CFG

PDG

65 of 80

AST

CFG

PDG

66 of 80

CFG

67 of 80

PDG

68 of 80

Code property graph

AST

CFG

PDG

69 of 80

Codes

Code property graph[2]

70 of 80

71 of 80

72 of 80

Idea

Find a subgraph that indicates the vulnerability

73 of 80

​

# AST

ast(node1, node2).

ast(node2, node3).

...

​

# CFG

cfg(node1, node4).

cfg(node4, node8).

...

​

# PDG

pdg(node3, node2).

...

AST

CFG

PDG

74 of 80

Joern

75 of 80

Implementation

​

# AST

ast(node1, node2).

ast(node2, node3).

...

​

# CFG

cfg(node1, node4).

cfg(node4, node8).

...

​

# REF

ref(node3, node2).

...

AST

CFG

REF

76 of 80

Implementation

​

# AST

ast(node1, node2).

ast(node2, node3).

...

​

# CFG

cfg(node1, node4).

cfg(node4, node8).

...

​

# REF

ref(node3, node2).

...

​

# Rule

​

​

​

bug(nodeA, nodeB):-

rule(node1, node4).

rule(node4, node8).

...

77 of 80

Implementation

​

# AST

ast(node1, node2).

ast(node2, node3).

...

​

# CFG

cfg(node1, node4).

cfg(node4, node8).

...

​

# REF

ref(node3, node2).

...

​

# Rule

​

bug(A,B) :- ancestor(A,C), ancestor(B,D), assignment(A), writeToPointer(B), alloc_doesnt_check_sizeOf(C), sizeOfInt(D).

78 of 80

Implementation

​

# Rule

​

bug(A,B) :- ancestor(A,C), ancestor(B,D), assignment(A), writeToPointer(B), alloc_doesnt_check_sizeOf(C), sizeOfInt(D).

79 of 80

Reference

  • ShiftLeft Inc. Joern documentation, 2019. [Online]. Available: https://joern.io/docs/. [Accessed: 28th Aug 2019].
  • Yann LeCun, Yoshua Bengio, et al. Convolutional networks for images, speech, and time series. The handbook of brain theory and neural networks, 3361(10):1995, 1995.
  • NIST. Juliet test suite v1.3, 2017. [Online]. Available: https://samate.nist.gov/SRD/testsuite.php. [Accessed: 28th Aug 2019].
  • F. Yamaguchi, N. Golde, D. Arp, and K. Rieck. Modeling and discovering vulnerabilities with code property graphs. In 2014 IEEE Symposium on Security and Privacy, pages 590–604, May 2014.

​

​

80 of 80

Thank you