Research On Software Vulnerability Analysis Technology Based On Deep Neural Network

Software vulnerability analysis is an important research content in cyber security.Current software vulnerability analysis methods suffer from low efficiency,poor accuracy and low versatility in analyzing vulnerabilities.At the same time,due to the long execution process,complex call relationship,and lots of conditional branches in realworld software,current methods face more challenges in analyzing real-world programs.Therefore,researching a new software vulnerability analysis method to achieve efficient analysis of large software vulnerabilities is important for repairing software vulnerabilities and protecting cyberspace security.The paper focuses on software vulnerability analysis technology based on deep neural network.First of all,the paper proposes a vulnerability analysis framework based on neural network and researches key methods in the framework.Secondly,focusing on the source code vulnerabilities,this paper proposes a vulnerability detection method based on the operation semantic features using deep neural network.Then,considering the difficulty of binary vulnerability analysis,this paper proposes a vulnerability root cause analysis method based on program execution trace.The main work and innovations of this paper are as follows:(1)A software vulnerability analysis framework based on deep neural network is proposed.Based on the limitations of existing vulnerability analysis methods,this paper proposes a software vulnerability analysis framework using deep neural network.Firstly,the paper discusses the concepts of software vulnerability analysis.Secondly,based on the limitations of current methods and the advantages of neural network methods,a vulnerability analysis framework based on neural network is proposed.Finally,the key methods in the framework are studied,including the input modeling method for program features,the neural network construction method and neural network interpretability analysis method.(2)A vulnerability detection method for source code based on operational semantics is proposed.In view of the shortcomings of the current vulnerability analysis method,the paper proposes a vulnerability detection method for source code based on operational semantics.Firstly,function names are analyzed as the operational semantics to represent the vulnerability feature,and a large number of function names are extracted from vulnerability library and open source programs as data sets.Secondly,the classifier is constructed using the Bidirectional Short Term Memory network to classify vulnerable function names and safe function names.Finally,we design experiments to evaluate the classification effect.Through the experiments on real-world programs FFmpeg and Lib TIFF,this method can detect and analyze the vulnerable functions in source code,which is not limited by vulnerability types and programming languages.(3)A root cause analysis method for binary vulnerabilities based on program execution traces is proposed.In view of the difficulty of binary vulnerability analysis,the paper proposes a method combined with deep neural network based on program execution trace.Firstly,we improve the test case generation algorithm based on the fuzzy technology,and generate the program execution traces by dynamic instrumentation technique.Secondly,with program execution traces as input,the convolutional neural network is used for learning.We research the neural network interpretability to analyze relationship between the basic block and the program crash,and further propose the method of identifying the vulnerable basic blocks from the crash execution trace.Finally,the effectiveness of the method is proved by experiments on multiple data sets and real-world programs.