Search papers, labs, and topics across Lattice.
This paper introduces a CNN-based model for vulnerability detection in C code, trained on a combined dataset from Draper Labs (static analyzer labels) and NIST SATE Juliet (human labels). The model tokenizes C code into 91 categories, uses binary vector encoding, and employs convolutional and pooling layers followed by fully connected layers for classification. The authors achieve higher recall than prior work (Russell et al.) at high precision and demonstrate the model's ability to find real vulnerabilities in a custom Linux kernel dataset with a low false-positive rate.
A specialized CNN can pinpoint real-world C code vulnerabilities with higher recall and precision than previous methods, even in complex codebases like the Linux kernel.
Each year, software vulnerabilities are discovered, which pose significant risks of exploitation and system compromise. We present a convolutional neural network model that can successfully identify bugs in C code. We trained our model using two complementary datasets: a machine-labeled dataset created by Draper Labs using three static analyzers and the NIST SATE Juliet human-labeled dataset designed for testing static analyzers. In contrast with the work of Russell et al. on these datasets, we focus on C programs, enabling us to specialize and optimize our detection techniques for this language. After removing duplicates from the dataset, we tokenize the input into 91 token categories. The category values are converted to a binary vector to save memory. Our first convolution layer is chosen so that the entire encoding of the token is presented to the filter. We use two convolution and pooling layers followed by two fully connected layers to classify programs into either a common weakness enumeration category or as "clean." We obtain higher recall than prior work by Russell et al. on this dataset when requiring high precision. We also demonstrate on a custom Linux kernel dataset that we are able to find real vulnerabilities in complex code with a low false-positive rate.
