基于LLM的跨架构物联网静态漏洞挖掘检测 参考文献

References:

  1. Y.Zhang, J.T.Li, X.Y.Song, et al. “Overview of IoT device security detection”(in Chinese),  Computer Research and Development, 2023, 60 (10): 2271-2290.
  2. K.KELLY. “The Ring Video Doorbell and the Entry of Amazon into the Smart Home: Implications for Consumer-Initiated Surveillance”, Journal of Consumer Policy, 2023, 46(1): 95-104.
  3. S. M. Sajjad, M. Yousaf, H. Afzal, et al. "eMUD: Enhanced Manufacturer Usage Description for IoT Botnets Prevention on Home WiFi Routers," in IEEE Access, vol. 8, pp. 164200-164213, 2020, doi: 10.1109/ACCESS.2020.3022272.
  4. D.A.Tanner, A.Hinchliffe, D.Santos. Threat assessment: Blackcat ransomware [EB/OL]. (2022-01-27) [2023-08-25]. https://unit42.Paloaltonetworks.com/blackcatransomware/
  5. D.BONAVENTURA, S.ESPOSITO, G.BELLA. Smart bulbs can be hacked to hack into your household arXiv preprint arXiv:2308.09019 (2023).
  6. Jason Wei, Yi Tay, Rishi Bommasani, et al.Emergent abilities of large language models [EB/OL]. [2023-03-10]. https://arxiv. org/pdf/2206.07682.pdf.
  7. Vaswani A,Shazeer N,Parmar N,et al.Attention is all you need[C]//Advances in Neural Information Processing Systems 30:Annual Conf on Neural Information Processing Systems 2017 New York:Curran Associates,2017:5998 6008.
  8. Emily M. Bender, Timnit Gebru, Angelina McMillan-Major, et al.On the dangers of stochastic parrots:Can language models be too big?[C]//Proc of the 2021 ACM Conf on Fairness,Accountability,and Transparency.New York:ACM,2021:610 623.
  9. GOERTZEL B. Artificial general intelligence:concept, state of the art, and future prospects[J].Journal of Artificial General Intelligence,2014,5(1):1-46.
  10. Alex Tamkin, Miles Brundage, Jack Clark, et al.Understanding the capabilities,limitations,and societal impact of large language models[J]arXiv preprint,arXiv:2102.02503,2021.
  11. Michael Fu, Chakkrit Tantithamthavorn. Linevul: a transformer-based linelevel vulnerability prediction. In Proceedings of the 19th International Conference on Mining Software Repositories, pages 608–620, 2022.
  12. Van-Anh Nguyen, Dai Quoc Nguyen, Van Nguyen, et al. Regvd: Revisiting graph neural networks for vulnerability detection. In Proceedings of the ACM/IEEE 44th International Conference on Software Engineering: Companion Proceedings, pages 178–182, 2022.
  13. Yiran Cheng, Lwin Khin Shar, Ting Zhang, et al. LLM-Enhanced Static Analysis for Precise Identification of Vulnerable OSS Versions[J]. arXiv preprint arXiv:2408.07321, 2024.
  14. W. M. Khoo, A. Mycroft, R. Anderson. Rendezvous: A search engine for binary code. In Proceedings of the 10th Working Conference on Mining Software Repositories, 2013.
  15. H. Flake. Structural comparison of executable objects. In DIMVA, volume 46, 2004.
  16. J. Pewny, B. Garmany, R. Gawlik, et al. Cross-Architecture Bug Search in Binary Executables[C]. IEEE Symposium on Security and Privacy, 2015.
  17. Eschweiler S, Yakdan K, Gerhards-Padilla E. discovRE: Efficient Cross-Architecture Identification of Bugs in Binary Code[J].  2016.DOI:10.14722/ndss.2016.23185.
  18. Feng Q, Zhou R, Xu C, et al. Scalable Graph-based Bug Search for Firmware Images[C]//Acm Sigsac Conference on Computer & Communications Security.ACM, 2016.DOI:10.1145/2976749.2978370.
  19. Franco Scarselli, Marco Gori, Ah Chung Tsoi, et al. 2009. The graph neural network model. IEEE Transactions on Neural Networks 20, 1 (2009), 61–80.
  20. Hanjun Dai, Bo Dai, Le Song. 2016. Discriminative Embeddings of Latent Variable Models for Structured Data. In International Conference on Machine Learning.
  21. Ding S H H, Fung B C M, Charland P. Asm2Vec: Boosting Static Representation Robustness for Binary Clone Search against Code Obfuscation and Compiler Optimization[J]. IEEE Computer Society, 2019, 10(1109): 472-489.
  22. X. Xu, C. Liu, Q. Feng, et al. “Neural Network-based Graph Embedding for Cross-Platform Binary Code Similarity Detection,” in Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. Dallas Texas USA: ACM, Oct. 2017, pp. 363–376. [Online]. Available: https://dl.acm.org/doi/10.1145/3133956.3134018
  23. Yujia Li,Chenjie Gu,Thomas Dullien,et al. Graph Matching Networks for Learning the Similarity of Graph Structured Objects[J]. International Conference on Machine Learning, 2019, 10(48550): 1904-12787.
  24. V. Cochard, D. Pfammatter, C. T. Duong, et al. "Investigating Graph Embedding Methods for Cross-Platform Binary Code Similarity Detection," 2022 IEEE 7th European Symposium on Security and Privacy (EuroS&P), Genoa, Italy, 2022, pp. 60-73, doi: 10.1109/EuroSP53844.2022.00012.
  25. Benjamin Steenhoek, Md Mahbubur Rahman, Richard Jiles, et al. An empirical study of deep learning models for vulnerability detection[C]//2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE). IEEE, 2023: 2237-2248.
  26. Wang J, Yu L, Luo X. Llmif: Augmented large language model for fuzzing iot devices[C]//2024 IEEE Symposium on Security and Privacy (SP). IEEE Computer Society, 2024: 196-196.
  27. Zhou X, Cao S, Sun X, et al. Large Language Model for Vulnerability Detection and Repair: Literature Review and the Road Ahead[J]. 2024.
  28. Weng C, Qin Y, Lin B, et al. Matsvd: Boosting statement-level vulnerability detection via dependency-based attention[C]//Proceedings of the 15th Asia-Pacific Symposium on Internetware. 2024: 115-124.
  29. Yang X, Wang S, Li Y, et al. Does data sampling improve deep learning-based vulnerability detection? Yeas! and Nays![C]//2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE). IEEE, 2023: 2287-2298.
  30. Ding Y, Fu Y, Ibrahim O, et al. Vulnerability detection with code language models: How far are we?[J]. arXiv preprint arXiv:2403.18624, 2024.
  31. Wen X C, Wang X, Gao C, et al. When less is enough: Positive and unlabeled learning model for vulnerability detection[C]//2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE). IEEE, 2023: 345-357.
  32. Kuang H, Yang F, Zhang L, et al. Leveraging user-defined identifiers for counterfactual data generation in source code vulnerability detection[C]//2023 IEEE 23rd International Working Conference on Source Code Analysis and Manipulation (SCAM). IEEE, 2023: 143-150.
  33. Devlin J, Chang M W, Lee K, et al. Bert: Pre-training of deep bidirectional transformers for language understanding[C]//Proceedings of the 2019 conference of the North American chapter of the association for computational linguistics: human language technologies, volume 1 (long and short papers). 2019: 4171-4186.
  34. Radford A, Wu J, Child R, et al. Language models are unsupervised multitask learners[J]. OpenAI blog, 2019, 1(8): 9.
  35. Liu Z, Tang Z, Zhang J, et al. Pre-training by predicting program dependencies for vulnerability analysis tasks[C]//Proceedings of the IEEE/ACM 46th International Conference on Software Engineering. 2024: 1-13.
  36. Peng T, Chen S, Zhu F, et al. PTLVD: Program Slicing and Transformer-based Line-level Vulnerability Detection System[C]//2023 IEEE 23rd International Working Conference on Source Code Analysis and Manipulation (SCAM). IEEE, 2023: 162-173.
  37. Wang H, Tang Z, Tan S H, et al. Combining structured static code information and dynamic symbolic traces for software vulnerability prediction[C]//Proceedings of the IEEE/ACM 46th International Conference on Software Engineering. 2024: 1-13.
  38. Zhang J, Liu Z, Hu X, et al. Vulnerability detection by learning from syntax-based execution paths of code[J]. IEEE Transactions on Software Engineering, 2023, 49(8): 4196-4212.
  39. Tran H C, Tran A D, Le K H. DetectVul: A statement-level code vulnerability detection for Python[J]. Future Generation Computer Systems, 2025, 163: 107504.
  40. Tang W, Tang M, Ban M, et al. CSGVD: A deep learning approach combining sequence and graph embedding for source code vulnerability detection[J]. Journal of Systems and Software, 2023, 199: 111623.
  41. Jiang Z, Sun W, Gu X, et al. DFEPT: data flow embedding for enhancing pre-trained model based vulnerability detection[C]//Proceedings of the 15th Asia-Pacific Symposium on Internetware. 2024: 95-104.
  42. Yang A Z H, Tian H, Ye H, et al. Security vulnerability detection with multitask self-instructed fine-tuning of large language models[J]. arXiv preprint arXiv:2406.05892, 2024.
  43. Ziems N, Wu S. Security vulnerability detection using deep learning natural language processing[C]//IEEE INFOCOM 2021-IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS). IEEE, 2021: 1-6.
  44. Hanif H, Maffeis S. Vulberta: Simplified source code pre-training for vulnerability detection[C]//2022 International joint conference on neural networks (IJCNN). IEEE, 2022: 1-8.
  45. Liu Y, Ott M, Goyal N, et al. Roberta: A robustly optimized bert pretraining approach[J]. arXiv preprint arXiv:1907.11692, 2019.
  46. Ni C, Yin X, Yang K, et al. Distinguishing look-alike innocent and vulnerable code by subtle semantic representation learning and explanation[C]//Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering. 2023: 1611-1622.
  47. Steenhoek B, Rahman M M, Sharmin S, et al. Do language models learn semantics of code? A case study in vulnerability detection[J]. arXiv preprint arXiv:2311.04109, 2023.
  48. Rahman M M, Ceka I, Mao C, et al. Towards causal deep learning for vulnerability detection[C]//Proceedings of the IEEE/ACM 46th international conference on software engineering. 2024: 1-11.
  49. Zhou X, Zhang T, Lo D. Large language model for vulnerability detection: Emerging results and future directions[C]//Proceedings of the 2024 ACM/IEEE 44th International Conference on Software Engineering: New Ideas and Emerging Results. 2024: 47-51.
  50. Fu M, Tantithamthavorn C K, Nguyen V, et al. Chatgpt for vulnerability detection, classification, and repair: How far are we?[C]//2023 30th Asia-Pacific Software Engineering Conference (APSEC). IEEE, 2023: 632-636.
  51. Zhou X, Tran D M, Le-Cong T, et al. Comparison of static application security testing tools and large language models for repo-level vulnerability detection[J]. arXiv preprint arXiv:2407.16235, 2024.
  52. Yin X. Pros and cons! evaluating chatgpt on software vulnerability[J]. arXiv preprint arXiv:2404.03994, 2024.
  53. Khare A, Dutta S, Li Z, et al. Understanding the effectiveness of large language models in detecting security vulnerabilities[J]. arXiv preprint arXiv:2311.16169, 2023.
  54. Zhang C, Liu H, Zeng J, et al. Prompt-enhanced software vulnerability detection using ChatGPT (2024)[J]. arXiv preprint arXiv:2308.12697.
  55. Kojima T, Gu S S, Reid M, et al. Large language models are zero-shot reasoners[J]. Advances in neural information processing systems, 2022, 35: 22199-22213.
  56. Ni C, Shen L, Xu X, et al. Learning-based models for vulnerability detection: An extensive study[J]. arXiv preprint arXiv:2408.07526, 2024.
  57. Liu Z, Liao Q, Gu W, et al. Software vulnerability detection with gpt and in-context learning[C]//2023 8th International Conference on Data Science in Cyberspace (DSC). IEEE, 2023: 229-236.
  58. Du X, Zheng G, Wang K, et al. Vul-rag: Enhancing llm-based vulnerability detection via knowledge-level rag[J]. arXiv preprint arXiv:2406.11147, 2024.
  59. Wen X C, Wang X, Chen Y, et al. Vuleval: Towards repository-level evaluation of software vulnerability detection[J]. arXiv preprint arXiv:2404.15596, 2024
  60. Wang L, Ma C, Feng X, et al. A survey on large language model based autonomous agents[J]. Frontiers of Computer Science, 2024, 18(6): 186345.
  61. Qin Y, Liang S, Ye Y, et al. Toolllm: Facilitating large language models to master 16000+ real-world apis[J]. arXiv preprint arXiv:2307.16789, 2023.
  62. Shao Z, Gong Y, Shen Y, et al. Enhancing retrieval-augmented large language models with iterative retrieval-generation synergy[J]. arXiv preprint arXiv:2305.15294, 2023.
  63. Trivedi H, Balasubramanian N, Khot T, et al. Interleaving retrieval with chain-of-thought reasoning for knowledge-intensive multi-step questions[J]. arXiv preprint arXiv:2212.10509, 2022.
  64. Asai A, Wu Z, Wang Y, et al. Self-rag: Learning to retrieve, generate, and critique through self-reflection[C]//The Twelfth International Conference on Learning Representations. 2023.
  65. “National Security Governance in the Digital Age” (in Chinese), Legal Times, 2025, (04): 6.
  66. J.Ma, H.Yuan. "Network Attack on Asian Winter Games: 3 U.S. Agents Wanted" (in Chinese), Global Times, April 16, 2025, p. 008.
  67. D.Y.Su. “Strengthening Cybersecurity Barriers to Safeguard National Security” (in Chinese), People's Posts and Telecommunications, April 15, 2025, p. 001.
  68. Y.P.Lai, Y.N.Wei. "Exploring the Ideological and Political Construction Path of Information Security Courses in Universities from the Perspective of Patriotism Education" (in Chinese), Journal of Yunnan University (Social Sciences Edition), 2025, (02): 135-144. [Online] Available: https://doi.org/10.19833/j.cnki.jyu.2025.02.003 (Accessed April 28, 2025).
  69. X.A.Zhong. "Elevating Vulnerability Governance to the National Security Level for Unified Deployment" (in Chinese), China Information Security, 2024, (05): 5.
  70. M.Cao, W.Ren. "Adhering to the Holistic National Security Concept: Accelerating Cybersecurity Vulnerability Governance to Empower New Quality Productive Forces Development" (in Chinese), China Information Security, 2024, (05): 20-22.
  71. Z.Xin, L.L.Hao, C.J.Hou, et al., "Cultivation Strategies for College Students' National Security Literacy in the Age of AI" (in Chinese), Journal of Electrical and Electronic Education, 2025, (01): 87-90.
  72. Szegedy C, Zaremba W, Sutskever I, et al. Intriguing properties of neural networks[J]. arXiv preprint arXiv:1312.6199, 2013.
  73. Goodfellow I J, Shlens J, Szegedy C. Explaining and harnessing adversarial examples[J]. arXiv preprint arXiv:1412.6572, 2014.

附中文参考文献:

[1]    张妍,黎家通,宋小祎,等. 物联网设备安全检测综述[J]. 计算机研究与发展,2023,60(10):2271-2290. DOI:10.7544/issn1000-1239.202330482.

评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值