Software Security Vulnerability Mining Based on Deep Learning [基于深度学习的软件安全漏洞挖掘]

作者：Gu M.; Sun H.; Han D.; Yang S.; Cao W.; Guo Z.; Cao C.; Wang W.; Zhang Y.

来源：Journal of Computer Research and Development, 2021, 58(10): 2140-2162.

DOI：10.7544/issn1000-1239.2021.20210620

• Code representation
• Deep learning
• IoT security
• Smart contract security
• Vulnerability mining

The increasing complexity of software and the diversified forms of security vulnerabilities have brought severe challenges to the research of software security vulnerabilities. Traditional vulnerability mining methods are inefficient and have problems such as high false positives and high false negatives, which have been unable to meet the increasing demands for software security. At present, a lot of research works have attempted to apply deep learning to the field of vulnerability mining to realize automated and intelligent vulnerability mining. This review conducts an in-depth investigation and analysis of the deep learning methods applied to the field of software security vulnerability mining. First, through collecting and analyzing existing research works of software security vulnerability mining based on deep learning, its general work framework and technical route are summarized. Subsequently, starting from the extraction of deep features, security vulnerability mining works with different code representation forms are classified and discussed. Then, specific areas of deep learning based software security vulnerability mining works are discussed systematically, especially in the field of the Internet of Things and smart contract security. Finally, based on the summary of existing research works, the challenges and opportunities in this filed are discussed, and the future research trends are presented.

• 单位
  西安电子科技大学; 中国科学院大学