融合滑动窗口和哈希函数的代码漏洞检测模型.

Aiming at the problem that traditional vulnerability detection classification requires the definition of artificial features, similarity matching algorithms cannot detect non-clonal vulnerabilities and there are large feature dimensions and only for function call in existing deep learning vulnerability detection methods, this paper proposed a deep learning method based on sliding window and hash function to perform static vulnerability detection and classification on source code. Firstly, it extracted the method body of the source code to form a positive and negative sample set constructed an abstract syntax tree for each sample, replaced the programmer-defined variable names and method names according to the node type in the syntax tree and serialized abstract syntax tree by preorder traversal. Then, it performed word segmentation on the node information in the abstract syntax tree node and assigned an independent node number for each word. Then, it further split the tree nodes to form a word sequence, and trained the vulnerability detection classification model based the sliding window and hash function. Finally, it selected two types of vulnerability data sets, i.e. CWE-190 and CWE-191,for experiments in the SARD data set. The accuracy and recall rate of the vulnerability detection classification model reach 97. 4% and 94. 2% for CWE-190 and 97. 6% and 95. 1 % for CWE-191 respectively. The results show that the model can effectively detect the types of security vulnerabilities in the code and it is superior to some existing methods. [ABSTRACT FROM AUTHOR]