No abstract

No abstract

Vulnerability detection is an important issue in software security. Although various data-driven vulnerability detection methods have been proposed, the task remains challenging since the diversity and complexity of real-world vulnerable code in syntax and semantics make it difficult to extract vulnerable features with regular deep learning models, especially in analyzing a large program. Moreover, the fact that real-world vulnerable codes contain a lot of redundant information unrelated to vulnerabilities will further aggravate the above problem. To mitigate such challenges, we define a novel code representation named Slice Property Graph (SPG), and then propose VulSPG, a new vulnerability detection approach using the improved R-GCN model with triple attention mechanism to identify potential vulnerabilities in SPG. Our approach has at least two advantages over other methods. First, our proposed SPG can reflect the rich semantics and explicit structural information that may be relevance to vulnerabilities, while eliminating as much irrelevant information as possible to reduce the complexity of graph. Second, VulSPG incorporates triple attention mechanism in R-GCNs to achieve more effective learning of vulnerability patterns from SPG. We have extensively evaluated VulSPG on two largescale datasets with programs from SARD and real-world projects. Experimental results prove the effectiveness and efficiency of VulSPG.

Due to the centralization of communication in the management of data generated by diverse Internet of Thing (IoT) devices, there is a lack of reliability when data is being transferred and stored. Among errors caused by various behaviors, Silent Data Corruption (SDC) error, owing to stealthy destruction without error prompt, is one of the most difficult data consistency problems in the storage system, whether it is a traditional multi-control, distributed storage, or public cloud storage. Nowadays, for SDC error detection, extracting instruction features to analyze vulnerabilities of programs or instructions has still not been fully explored. Literature generally just count the number of possible features, without mining the inter-characteristic of the instruction and correlation between them. Thus, we propose a method of SDC-causing Error Detection based on Support Vector Regression (SED-SVR) for fully exploiting the correlation between data features. Specifically, firstly, we extract instruction features based on the SDC vulnerability of program instructions by analyzing results of fault injections. Secondly, we establish the instruction SDC vulnerability prediction model based on SVR and propose our SED-SVR model. Thirdly, according to the predicted values of SDC vulnerability, we develop some solutions for faults tolerance of target programs by different granularity of instruction redundancy. The experimental results show that our SED-SVR has higher fault detection rate with lower performance overhead.

No abstract