| Software security has become an unavoidable topic on the Internet,as windows applications are now inseparable from all walks of life.Vulnerabilities are the root cause of software security problems,and buffer overflow vulnerabilities are among the most dangerous ones,so it is especially important to detect them effectively.Traditional vulnerability detection methods have low detection efficiency and high leakage and false alarm rates,and vulnerability detection methods based on deep learning have become the focus of current research.This paper addresses the loss of information during code representation,the fine-grained nature of vulnerability detection and vulnerability localization,with the following work.1.A buffer overflow vulnerability detection method based on graph feature extraction is proposed to address the problem of information loss in the code representation process and the inability of existing methods to learn features related to vulnerabilities,resulting in high false negative rates and low accuracy.A buffer overflow function sample is first constructed,and then a new Code Representation Sequence(Co RS)structure is proposed that combines the control flow,data dependency and syntax information of the vulnerable code to reduce the information loss during code representation.The final function sample is transformed into a Co RS that uses a deep learning model to learn vulnerability features and perform vulnerability detection.2.To address the problem that current deep learning-based methods are unable to accurately predict the location of vulnerabilities,leading to major limitations in real-world use,a vulnerability location method based on assembly language and deep learning is proposed,which can achieve high detection capability and high location accuracy.The method first compiles and disassembles C language programs to obtain assembly code containing address information.Then,the addr2 line tool is used to generate a mapping between assembly code and source code line numbers,and the assembly code is sliced in function units to obtain code blocks,which are then encoded as vectors and used as input to a neural network model.Finally,a BLSTM-LOC model is proposed to extract and learn vulnerability features and predict vulnerability locations.In this paper,we propose a solution based on graph feature extraction to address the problem of information loss in the process of code representation,and a vulnerability location method based on assembly language and deep learning to address the problem of insufficient granularity in vulnerability detection and inability to predict the location of vulnerabilities.Experimental results show that an accuracy rate of 97.8% and an average localization error of0.78 lines are achieved on the public dataset,which greatly improves the vulnerability detection performance. |
