D2A: A Dataset Built for AI-Based Vulnerability Detection Methods Using Differential Analysis
| Autor: | Zhong Su, Saurabh Pujar, Alessandro Morari, Bo Yang, Jim A. Laredo, Luca Buratti, Burn L. Lewis, Edward A. Epstein, Yunhui Zheng |
|---|---|
| Rok vydání: | 2021 |
| Předmět: |
FOS: Computer and information sciences
Computer Science - Machine Learning Source code Source lines of code Computer Science - Artificial Intelligence Computer science business.industry media_common.quotation_subject Static program analysis Context (language use) Static analysis Machine learning computer.software_genre Machine Learning (cs.LG) Software Engineering (cs.SE) Computer Science - Software Engineering Identification (information) Artificial Intelligence (cs.AI) Software bug Artificial intelligence business computer media_common Vulnerability (computing) |
| Zdroj: | ICSE (SEIP) |
| DOI: | 10.1109/icse-seip52600.2021.00020 |
| Popis: | Static analysis tools are widely used for vulnerability detection as they understand programs with complex behavior and millions of lines of code. Despite their popularity, static analysis tools are known to generate an excess of false positives. The recent ability of Machine Learning models to understand programming languages opens new possibilities when applied to static analysis. However, existing datasets to train models for vulnerability identification suffer from multiple limitations such as limited bug context, limited size, and synthetic and unrealistic source code. We propose D2A, a differential analysis based approach to label issues reported by static analysis tools. The D2A dataset is built by analyzing version pairs from multiple open source projects. From each project, we select bug fixing commits and we run static analysis on the versions before and after such commits. If some issues detected in a before-commit version disappear in the corresponding after-commit version, they are very likely to be real bugs that got fixed by the commit. We use D2A to generate a large labeled dataset to train models for vulnerability identification. We show that the dataset can be used to build a classifier to identify possible false alarms among the issues reported by static analysis, hence helping developers prioritize and investigate potential true positives first. Accepted to the 43rd International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP '21) |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|