Improve vulnerability prediction performance using self-attention mechanism and convolutional neural network

Abstract

With the vigorous development of the Internet, the number of commonly used software has also increased rapidly. The security and reliability of software have become important challenges that researchers must deal with. Fuzzing is a way of detecting vulnerabilities by providing unintended inputs to the target software and observing the final running results. During these years, fuzzing has proven its effectiveness in software security testing. But a large number of fuzzing tools rely solely on runtime information while testing software. Achieving static vulnerability prediction for programs in advance can greatly improve the efficiency of fuzzing. Vulnerability prediction aims to obtain the possibility of vulnerabilities in different parts of the program. The existing vulnerability prediction methods are relatively simple for feature extraction between basic blocks. We design a novel model combining self-attention mechanism and convolutional neural networks, which can extract and integrate the internal information of functions. Compared with the state-of-the-art V-Fuzz, our recall can be improved by 9.7 percentage points, and the accuracies of K-100~K-1000 can be higher than 90%.