- 學位論文
偵測軟體漏洞的自動化方法:基於長短期記憶雙向殘差神經網絡
An automatic methodology of detecting vulnerabilities in software using Bi-directional long short-term memory residual neural network
摘要
零日攻擊是一個未公開的漏洞，黑客可以利用該漏洞對計算機程序產生不利影 響。 2017 年5 月，零日勒索軟件WannaCry 造成了全球性災難，從入侵英國國家衛生 服務系統的醫院離線到關閉日本本田汽車公司[1]，在世界範圍內造成了無數經 濟損失。 WannaCry 通過EternalBlue 傳播，EternalBlue 是美國國家安全局（NSA）針對 較舊的Windows 系統開發的零時差漏洞。 到目前為止，零日攻擊仍在出現，在任何時間點，這種網絡威脅引起了對零日檢 測軟件漏洞的關注，成為一個必須要解決的迫切問題。 隨著黑客技術的發展，漏洞數量呈指數級增長。 從2010 年到2015 年，在CVE（通用漏洞枚舉）中新註冊的大約80,000 個漏洞 的數量正在增加[3]對於軟件漏洞檢測，傳統解決方案分別有其缺點，對於靜態 分析（使用特徵辨析）中的特徵提取通常取決於專家經驗來人為定義。 人工分析不僅容易出錯，而且耗時，而對於基於符號執行的其他狀態解決方案， 它們經常會遇到路徑爆炸問題，從而導致在大型項目中難以實施。 在這種情況下，一種既高效又準確的自動化漏洞檢測的新方法已成為當務之急。 近年來，有許多研究團隊致力於漏洞檢測的自動化。例如NeuFuzzy [5]使用深 度學習提高模糊測試的效率，以及VulDeePecker（Vulnerability Deep Pecker） 基於深度學習的漏洞檢測方法，從而無需手動定義功能。 在本文中，我們基於現有的用於靜態分析的雙向LSTM 實現了我們框架的原型， 並在兩個不同的測試套件上對其進行了評估： LAVA-M 和四個實際應用程序。實驗結果表明我們的框架可以找到 比現行方法更多的漏洞。
並列摘要
A zero-day attack is an undisclosed vulnerability that hackers can exploit to adversely affect computer programs. May 2017, a zero-day ransomware WannaCry has caused world-wide catastrophe, from knocking U.K. National Health Service hospitalsoffline to shutting down a Honda Motor Company in Japan [1], caused numerous economic damage around the world. The WannaCry propagated through EternalBlue, a zero-day developed by the United States National Security Agency (NSA) for olderWindows systems [2]. So far, Zero-day attacks are still emerging, thus at that point in time, such cyber threat draw the attention in zero-day detecting software vulnerability become a critical problem. As hacking techniques become advanced, vulnerabilities have been exponentially increasing. The number of vulnerabilities in which about 80,000 vulnerabilities are newly registered in CVE (Common Vulnerability Enumeration) from 2010 to 2015 is increasing [3]. For software vulnerability detection, the traditional solution have its own shortcoming respectively, for presence solutions in static analysis like pattern recolonization is often depended on the expert experience to manually defined features. Artificial analysis not only an error-prone task but also a time consuming job, for another presence solutions based on symbolic execution, they often have path explosion problem resulting in having difficulty implementing in large project. In this context, a new way for automation of vulnerability detection with both high efficiency and accuracy become a matter of urgency. In recent years, there are number of research teams have committed themselves on automation of vulnerabilities detection. like NeuFuzzy [5] using the deep learning to improve the efficiency of Fuzzy test, and VulDeePecker(Vulnerability Deep Pecker) a vulnerability detection method based on deep learning, which eliminates the need to manually define features. In this paper, we implemented a prototype of our framework based on an existing Bidirectional LSTM for static analysis and evaluated it on two different test suites: LAVA-M and four real-world applications. The experimental results showed that our framework can find more vulnerabilities than the presence work. We have found 8 new security bugs in these applications, 6 of which have been assigned as CVE IDs. Index Terms— Software security, Deep Learning, zero-day, static analysis, software analysis.
參考文獻
延伸閱讀
- 楊慧萍（2005）。以類神經網路建立偵測自我相關製程平均值偏移和參數估計之雙邊管制法〔碩士論文，元智大學〕。華藝線上圖書館。https://www.airitilibrary.com/Article/Detail?DocID=U0009-0112200611350258
- 黃馨誼（2020）。使用基於長短期記憶的生成對抗網路實現自動智慧影片編輯〔碩士論文，國立臺灣大學〕。華藝線上圖書館。https://doi.org/10.6342/NTU202004171
- Tsung, H. C. (2022). 應用類神經網路、卷積神經網路與長短期記憶模型預測動態隨機存取記憶體價格 [master's thesis, National Taiwan Normal University]. Airiti Library. https://doi.org/10.6345/NTNU202201589
- 洪雅雯（2019）。應用結合卷積神經網絡與雙向長短期記憶神經網絡進行短期風速預測〔碩士論文，逢甲大學〕。華藝線上圖書館。https://doi.org/10.6341/fcu.M0603591
- 蔡薰儀 (2012). Suspicious Behavior-based Malware Detection Using Artificial Neural Network [master's thesis, National Chiao Tung University]. Airiti Library. https://doi.org/10.6842/NCTU.2012.00422