Program Dependency Graph Embedding for Automated Detection of Security Weaknesses in Software Systems

Abstract

Modern software becomes more complicated with each passing day. The more complex software becomes, the more difficulty standard static analyses have at detecting security weaknesses. During the relatively simple phases of the software engineering lifecycle, identifying security weaknesses is fundamental, and identifying weaknesses early yield larger, returns in the software's revenue stream. Some previous research has been conducted using both machine learning and software structures through program dependency graphs of control and data flow structures of source codes. However, a great deal of previous research has relied on underdefined structural properties of complex software systems. In this regard, this research provides a framework for program dependency graphs for the automated detection of weaknesses of security in software development. This framework provides a way of detecting complex interrelations through the construction of dependency graphs from source codes, where structural features of the dependent graphs are encoded, interrelations of program codes or pathways of execution are studied, and complex interrelations are detected. The framework answers how to determine the balance between detection and classification and time and runtime.