{"id":23315,"date":"2024-12-15T16:26:54","date_gmt":"2024-12-15T09:26:54","guid":{"rendered":"https:\/\/stei.itb.ac.id\/?page_id=23315"},"modified":"2024-12-16T08:36:43","modified_gmt":"2024-12-16T01:36:43","slug":"detecting-vulnerability-in-open-source-projects-using-deep-learning","status":"publish","type":"page","link":"https:\/\/stei.itb.ac.id\/en\/prima\/detecting-vulnerability-in-open-source-projects-using-deep-learning\/","title":{"rendered":"Detecting Vulnerability in Open Source Projects using Deep Learning"},"content":{"rendered":"<div class=\"wpb-content-wrapper\"><div class=\"fullwidth\" ><div class=\"vc_row wpb_row vc_row-fluid kepala vc_custom_1734236300248 vc_row-has-fill\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"container\" ><div class=\"vc_row wpb_row vc_inner vc_row-fluid\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"vc_btn3-container vc_btn3-inline vc_do_btn\" ><button class=\"vc_general vc_btn3 vc_btn3-size-lg vc_btn3-shape-rounded vc_btn3-style-modern vc_btn3-icon-left vc_btn3-color-white\" onclick=\"history.back()\"><i class=\"vc_btn3-icon fas fa-home\"><\/i> Kembali ke Beranda<\/button><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><div class=\"fullwidth\" ><div class=\"vc_row wpb_row vc_row-fluid vc_custom_1734170418007\"><div class=\"wpb_column vc_column_container vc_col-sm-3\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div class=\"wpb_text_column wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p><strong>Yudistira Asnar<\/strong><br \/>\nSTEI ITB<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><div class=\"wpb_column vc_column_container vc_col-sm-3\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div class=\"wpb_text_column wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p><strong>Bayu Samudra<\/strong><br \/>\nMagister Informatika STEI-ITB<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><div class=\"wpb_column vc_column_container vc_col-sm-3\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div class=\"wpb_text_column wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p><strong>Fawwaz A. Wiradhika<\/strong><br \/>\nMagister Informatika STEI-ITB<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><div class=\"wpb_column vc_column_container vc_col-sm-3\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div class=\"wpb_text_column wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p><strong>Alifia Rahmah<\/strong><br \/>\nMagister Informatika STEI-ITB<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><div class=\"fullwidth\" ><div class=\"vc_row wpb_row vc_row-fluid vc_custom_1734168902943\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div class=\"wpb_text_column wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p><strong>Abstract<\/strong><br \/>\nThe increasing reliance on open-source software has amplified the need for effective vulnerability detection mechanisms. This research focuses on investigating existing literature and methodologies in the domain of vulnerability detection in open-source projects.<br \/>\nBy analyzing state-of-the-art approaches, including Pre-processing Techniques, Encoder Architectures, Neural Networks, and other machine learning techniques, we aim to identify their strengths and limitations. Our objective is to enhance the current state of the art by selectively integrating and improving upon these methodologies. The proposed research will explore novel combinations of deep learning models and feature engineering techniques to achieve higher performant in vulnerability detection. This poster outlines our research objectives, methodology, and the anticipated contributions to the field of software security. Through this exploration, we hope to provide practical frameworks, consisting the best techniques, that are best suited and can be adopted by developers and researchers alike to bolster the security of open-source software projects.<\/p>\n<p><strong>Keyword:<\/strong> Vulnerability Detection, Deep Learning, Pre-processing<\/p>\n<p><strong>Introduction<\/strong><br \/>\nOpen Source Software (OSS) recently increasing in popularity to be used by developer. However, OSS also carries high security risks since its open-source nature allows for potential vulnerabilities in the code, which can be exploited by attackers. Therefore, it is crucial to develop effective vulnerability detection mechanisms. One approach to detecting vulnerabilities in OSS is static code analysis, a technique that analyzes the source code without executing it. A lot of research have delved into static analysis. The most promising result so far is vulnerability detection using deep learning. Three of them are: (1), (2), and (3).<\/p>\n<p><strong>VulnDetect Framework<\/strong><br \/>\nIn this research, we present the VulnDetect Framework, which is composed of five stages: Data Collection &amp; Labeling, Data Processing, Feature Extraction, Model Training, and Model Evaluation.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><div class=\"fullwidth\" ><div class=\"vc_row wpb_row vc_row-fluid vc_custom_1734169162466 vc_row-o-content-bottom vc_row-flex\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div  class=\"wpb_single_image wpb_content_element vc_align_center wpb_content_element\">\n\t\t\n\t\t<figure class=\"wpb_wrapper vc_figure\">\n\t\t\t<div class=\"vc_single_image-wrapper   vc_box_border_grey\"><img loading=\"lazy\" decoding=\"async\" width=\"733\" height=\"513\" src=\"https:\/\/stei.itb.ac.id\/wp-content\/uploads\/44a.jpg\" class=\"vc_single_image-img attachment-full\" alt=\"\" title=\"44a\" \/><\/div><figcaption class=\"vc_figure-caption\">Figure 1. VulnDetect Framework Pipeline<\/figcaption>\n\t\t<\/figure>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><div class=\"fullwidth\" ><div class=\"vc_row wpb_row vc_row-fluid vc_custom_1734168902943\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div class=\"wpb_text_column wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>At Data Collection &amp; Labelling stage, we gather datasets from Open Source Software (OSS) Projects and label them according to their vulnerabilities adapting from (1).<br \/>\nDuring the Data Preprocessing stage, the dataset is tokenized and normalized.<br \/>\nFurthermore, the dataset&#8217;s features are augmented by including various aspects found in programming languages (PLs). This phase also involves the creation of graph-based features like Abstract Syntax Trees (AST), Program Dependency Graphs (PDG), and other relevant features for the modeling phase. This phase can help enrich information from the source code and preserver syntax-semantic meaning of the code. This phase can help the model to learn better.<br \/>\nIn the Feature Extraction stage, the tokenized data is converted into a format that can be interpreted. For this research, we study various techniques: CodeBERT, Code2Vec, and Code2Seq as our feature extractors, preferring them over NLP-based extractors like Word2Vec or Glove due to the unique characteristics of PLS. PLs are markedly different from natural languages (NLs) due to their rigid syntax, grammar, and deterministic semantics.<br \/>\nThe Modeling stage involves selecting and tuning the model based on its hyperparameters, followed by training the model. In this research, we utilize sequence-based model and graph- based model. In this research, we use two type classification, the bi-class classification (vulnerable\/not) and multi-class classification (not vulnerable\/vulnerability-1\/vulnerability-2,&#8230;, n).<br \/>\nThe final stage in our pipeline is the Model Evaluation, where the model is assessed using chosen metrics.<\/p>\n<p>Here are model evaluation of (1), (2), (3) that are using various techniques:<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><div class=\"fullwidth\" ><div class=\"vc_row wpb_row vc_row-fluid vc_custom_1734169162466 vc_row-o-content-bottom vc_row-flex\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div  class=\"wpb_single_image wpb_content_element vc_align_left wpb_content_element\">\n\t\t\n\t\t<figure class=\"wpb_wrapper vc_figure\">\n\t\t\t<div class=\"vc_single_image-wrapper   vc_box_border_grey\"><img loading=\"lazy\" decoding=\"async\" width=\"150\" height=\"61\" src=\"https:\/\/stei.itb.ac.id\/wp-content\/uploads\/44b.jpg\" class=\"vc_single_image-img attachment-thumbnail\" alt=\"\" title=\"44b\" \/><\/div>\n\t\t<\/figure>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><div class=\"fullwidth\" ><div class=\"vc_row wpb_row vc_row-fluid vc_custom_1734168902943\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div class=\"wpb_text_column wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>These results are not justifying which methods are the best, as those studies are different approaches on building the models and not using the same dataset. Additionally, project types, programming languages, and other factors contributes to the performance of those models.<br \/>\nLi, G. and Yang, Y. (2024) compare various deep learning model which broadly divided into two type, sequence-based and graph-based. While sequence-based model can find pattern in token sequence but overlooking structural information, context, and interaction in code. Graph-based model alleviate this problem by integrating complex information, such as logical structure and relationships in the code in the form of graph. However, when applied to large- scale program, the graph become very complex making feature extraction difficult, which affect scalability of graph-based model. Additionally, noisy edge can obscure critical patterns and capturing long range dependencies still become challenge in graph-based model.<\/p>\n<p><strong>Conclusion<\/strong><br \/>\nIn summary, the increasing complexity of open- source software highlights the urgent need for effective vulnerability detection mechanisms. Our research aims to enhance existing methodologies by conducting a thorough review of current literature and identifying gaps in traditional approaches.<br \/>\nBy integrating advanced machine learning techniques, such as Pre-processing Techniques, Encoder Architectures, Neural Networks, we expect to improve the accuracy and efficiency of vulnerability detection. Our goal is to develop a hybrid model that combines the strengths of various techniques, providing a more robust solution to software vulnerabilities.<br \/>\nThis research has the potential to significantly advance the field of software security, enabling developers and organizations to better protect their systems. Future work will focus on empirical validation of our proposed methods and collaboration with industry partners to ensure practical relevance.<\/p>\n<p><strong>Main References<\/strong><\/p>\n<p>1) VUDENC: Vulnerability Detection with Deep Learning on a Natural Codebase for Python (Wartschinski et al., 2020)<br \/>\n2) Vulnerability detection with interpretations (Li et al., 2021)<br \/>\n3) fine-grained Machine Learning Techniques for Python Source Code Vulnerability Detection (Farasat and Posegga, 2024)<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"Kembali ke Beranda Yudistira Asnar STEI-ITB Bayu Samudra Magister Informatika STEI-ITB Fawwaz A. Wiradhika Magister Informatika STEI-ITB Alifia Rahmah Magister Informatika STEI-ITB Abstract The increasing reliance on open-source software has [...]","protected":false},"author":1,"featured_media":0,"parent":22933,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-23315","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/stei.itb.ac.id\/en\/wp-json\/wp\/v2\/pages\/23315","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/stei.itb.ac.id\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/stei.itb.ac.id\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/stei.itb.ac.id\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/stei.itb.ac.id\/en\/wp-json\/wp\/v2\/comments?post=23315"}],"version-history":[{"count":5,"href":"https:\/\/stei.itb.ac.id\/en\/wp-json\/wp\/v2\/pages\/23315\/revisions"}],"predecessor-version":[{"id":23590,"href":"https:\/\/stei.itb.ac.id\/en\/wp-json\/wp\/v2\/pages\/23315\/revisions\/23590"}],"up":[{"embeddable":true,"href":"https:\/\/stei.itb.ac.id\/en\/wp-json\/wp\/v2\/pages\/22933"}],"wp:attachment":[{"href":"https:\/\/stei.itb.ac.id\/en\/wp-json\/wp\/v2\/media?parent=23315"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}