DeepWukong

(TOSEM'21) DeepWukong: Statically Detecting Software Vulnerabilities Using Deep Graph Neural Network

Setup

• Environment

  bash env.sh

• Preprocessed Data

  Download from data, and unzip the data under <project root>/data folder.

One-Step Evaluation

• From Pretrained model

  • Download from pretrained model.
  • PYTHONPATH="." python src/evaluate.py <path to the pretrained model>

• Training and Testing

  bash run.sh

Run from scratch:

Data preparation

Use joern to Generate PDG

We use the old version of joern to generate PDG

PYTHONPATH="." python src/joern/joern-parse.py -c <config file>

Generate raw XFG

PYTHONPATH="." python src/data_generator.py -c <config file>

Symbolize and Split Dataset

PYTHONPATH="." python src/preprocess/dataset_generator.py -c <config file>

Word Embedding Pretraining

PYTHONPATH="." python src/preprocess/word_embedding.py -c <config file>

Evaluation

PYTHONPATH="." python src/run.py -c <config file>

Citation

Please kindly cite our paper if it benefits:

@article{xiao2021deepwukong,
author = {Cheng, Xiao and Wang, Haoyu and Hua, Jiayi and Xu, Guoai and Sui, Yulei},
title = {DeepWukong: Statically Detecting Software Vulnerabilities Using Deep Graph Neural Network},
year = {2021},
publisher = {ACM},
volume = {30},
number = {3},
url = {https://doi.org/10.1145/3436877},
doi = {10.1145/3436877},
journal = {ACM Trans. Softw. Eng. Methodol.},
articleno = {38},
numpages = {33}
}