cyber security

FGVulDet – New Vulnerability Detector to Analyze Source Code

Detecting source code vulnerabilities aims to protect software systems from attacks by identifying inherent vulnerabilities. 

Prior studies often oversimplify the problem into binary classification tasks, which poses challenges for deep learning models to effectively learn diverse vulnerability characteristics. 

To address this, the following cybersecurity analysts introduced FGVulDet, a fine-grained vulnerability detector that employs multiple classifiers to discern various vulnerability types:-

  • Shangqing Liu from Nanyang Technological University
  • Wei Ma from Nanyang Technological University
  • Jian Wang from Nanyang Technological University
  • Xiaofei Xie from Singapore Management University
  • Ruitao Feng from Singapore Management University
  • Yang Liu from Nanyang Technological University

FGVulDet Vulnerability Detector

Each classifier learns type-specific semantics, and researchers propose a novel data augmentation technique to enhance diversity in the training dataset. 

Inspired by graph neural networks, FGVulDet utilizes an edge-aware GGNN to capture program semantics from a large-scale GitHub dataset encompassing five vulnerability types.

Five Vulnerability Types

Previous works have simplified the identification of source code vulnerability into a binary classification problem where all defect-prone functions are labeled as 1.

This approach lacks accuracy because it does not consider types of particular vulnerabilities.

However, in contrast to this, the researchers’ approach focuses on fine-grained vulnerability identification and aims to learn prediction functions for distinct vulnerability types within a dataset. 

Each function is categorized based on its vulnerability type to predict its vulnerability status.

Their framework has three core parts:-

  • Data Collection
  • Vulnerability-preserving Data Augmentation
  • Edge-aware GGNN

On the other hand, researchers train multiple binary classifiers for different vulnerability types and aggregate their predictions through voting during the prediction phase.

This task is difficult as obtaining high-quality datasets covering a broad range of vulnerabilities requires specialist knowledge.

The framework of FGVulDet (Source – Arxiv)

GGNN is a very famous source code modeling approach that is limited to node representations without considering the edge information.

In this case, it’s aimed at proposing an edge-sensitive GGNN that can effectively use edge semantics in vulnerability detection.

Each type of vulnerability has its own binary classifier, which is trained by using datasets of both vulnerable and non-vulnerable functions.

The final prediction is made through majority voting across all the classifiers.

Since the researchers’ dataset includes common vulnerabilities so, it can be extended for detecting others as well.

On the other hand, FGVulDet employs multiple classifiers and a novel data augmentation technique for effective fine-grained vulnerability detection.

Looking to Safeguard Your Company from Advanced Cyber Threats? Deploy TrustNet to Your Radar ASAP.

Tushar Subhra Dutta

Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Recent Posts

Hackers Exploiting Docusign With Phishing Attack To Steal Credentials

Hackers prefer phishing as it exploits human vulnerabilities rather than technical flaws which make it a highly effective and low-cost…

1 day ago

Norway Recommends Replacing SSLVPN/WebVPN to Stop Cyber Attacks

A very important message from the Norwegian National Cyber Security Centre (NCSC) says that Secure Socket Layer/Transport Layer Security (SSL/TLS)…

3 days ago

New Linux Backdoor Attacking Linux Users Via Installation Packages

Linux is widely used in numerous servers, cloud infrastructure, and Internet of Things devices, which makes it an attractive target…

3 days ago

ViperSoftX Malware Uses Deep Learning Model To Execute Commands

ViperSoftX malware, known for stealing cryptocurrency information, now leverages Tesseract, an open-source OCR engine, to target infected systems, which extracts…

3 days ago

Santander Data Breach: Hackers Accessed Company Database

Santander has confirmed that there was a major data breach that affected its workers and customers in Spain, Uruguay, and…

3 days ago

U.S. Govt Announces Rewards up to $5 Million for North Korean IT Workers

The U.S. government has offered a prize of up to $5 million for information that leads to the arrest and…

3 days ago