Learning to Identify Security-Related Issues Using Convolutional Neural Networks

TL;DR

This paper introduces SecureReqNet, a neural network-based method that automatically identifies security-related issues in software issue descriptions using natural language processing, achieving high accuracy on open source and industrial datasets.

Contribution

The paper presents a novel two-phase neural network architecture that learns from vulnerability descriptions to detect security-related issues in natural language.

Findings

Achieved 96% accuracy on open source issues

Achieved 71.6% accuracy on industrial requirements

Demonstrated effectiveness of NLP-based security issue classification

Abstract

Software security is becoming a high priority for both large companies and start-ups alike due to the increasing potential for harm that vulnerabilities and breaches carry with them. However, attaining robust security assurance while delivering features requires a precarious balancing act in the context of agile development practices. One path forward to help aid development teams in securing their software products is through the design and development of security-focused automation. Ergo, we present a novel approach, called SecureReqNet, for automatically identifying whether issues in software issue tracking systems describe security-related content. Our approach consists of a two-phase neural net architecture that operates purely on the natural language descriptions of issues. The first phase of our approach learns high dimensional word embeddings from hundreds of thousands of vulnerability descriptions listed in the CVE database and issue descriptions extracted from open source projects. The second phase then utilizes the semantic ontology represented by these embeddings to train a convolutional neural network capable of predicting whether a given issue is security-related. We evaluated SecureReqNet by applying it to identify security-related issues from a dataset of thousands of issues mined from popular projects on GitLab and GitHub. In addition, we also applied our approach to identify security-related requirements from a commercial software project developed by a major telecommunication company. Our preliminary results are encouraging, with SecureReqNet achieving an accuracy of 96% on open source issues and 71.6% on industrial requirements.

Tables

Table 1. TABLE I: Datasets utilized in the empirical evaluation. security-related requirements ( SR ) and non security-related requirements ( Non-SR ).

	Embedding Dataset	Training Dataset	Validation Dataset	Testing Dataset
Dataset Source	Number of Documents
CVE Database	52,908	37,036	10,582	-
GitLab (SR)	578	405	116	58
GitLab (Non-SR)	578	405	116	58
GitHub (SR)	4,575	3,203	915	458
GitHub (Non-SR)	47,483	33,238	9,497	458
Wikipedia	10,000	-	-	-
Industry (SR)	-	-	-	24
Industry (Non-SR)	-	-	-	45

Table 2. TABLE II: Neural Network Architectures Results - Bold numbers represent best results

Neural Network Architecture	Kernels (n-gram)	#Params	Opt. Capacity (epochs)	Best Model (epochs)	Industry Test Dataset			Issues Test Dataset
					Loss	Acc.	AUC	Loss	Acc.	AUC
SecureReqNet (shallow)	[1/3/5]	116,354	101	25	1.4325	0.7164	0.7	0.231	0.96	0.984
SecureReqNet (deep)	[1/3/5]	662,018	104	4	0.859	0.7015	0.668	0.4044	0.8358	0.928
Alex-SecureReqNet (deep)	[7$\to$3]	6,052,866	112	72	5.2794	0.6567	0.5	7.6972	0.498	0.5
$\alpha$-SecureReqNet (deep)	[7$\to$3]	100,946	104	40	2.3793	0.7164	0.747	0.2615	0.958	0.986

Full text

I Introduction

Software has pervaded nearly every facet of modern society. From banking, to art, to entertainment, the benefits that the general public has enjoyed from the automation and ease of use afforded by software applications is unprecedented. However, the pervasive nature of modern software systems is a double-edged sword, as more security- and privacy- sensitive data is being managed by software than ever before. Thus, the potential negative impacts of software vulnerabilities or breaches is higher than ever. This can be readily seen in the fallout from high-profile data breaches of companies such as Experian [2]. Furthermore, past studies related to security requirements have observed that development teams often do not focus on security early in the development process [18] and reconciling the implementation of security patches and fixes with general maintenance related to bugs is a challenging task as software evolves [15]. As the implications of software security and safety have grown, so has the need for practitioners to take proactive measures to ensure the integrity of their software systems during the development process.

Security procedures have become deeply integrated into agile software development practices principles [3] due to the constraints these practices impose [23]. For instance, companies like Cisco Systems, Inc. and Microsoft Corp. have been generating and adopting standards such as the Secure Development Lifecycle (SDL) [1, 4] to effectively integrate security practices into the Agile development process. However, in order to enable these development teams to implement proactive software security practices, new tools are required that automate repetitive or intellectually-intensive tasks that would otherwise be delayed or abandoned during typical software development and maintenance cycles. In this paper, we aim to enable such automation by designing and evaluating an approach that is capable of automatically differentiating between security-related (SR) and non-security related (non-SR) issues. This binary classification is performed in issue tracking systems using as input only the Natural Language (NL) contents of issue descriptions.

Software teams often use issue tracking systems to record requirements, organize their work, and manage bug reporting. As such, issues often contain information related to the security requirements of an associated software project. We posit that an effective technique for automating the identification of issues that contain SR information can aid developers in at least the following four ways: (i) when issues are used to specify NL software requirements, automated identification of SR issues could help developers more easily identify and prioritize overlooked security-critical requirements; (ii) issues that contain incoming security-sensitive bug reports can be readily identified and more effectively prioritized and resolved; (iii) the contents of automatically identified security issues could be used to refine and focus future automated techniques for traceability or feature location towards higher effectiveness on security-critical software artifacts; (iv) identified SR issues could be more effectively assigned to engineers with skills and experience in security-critical software development.

Given the potentially positive impact that an effective automated security issue identification approach might have on developers, in this paper we design and implement a novel technique for this problem based upon Natural Language processing (NLP) techniques and Convolutional Neural Networks (CNNs). Our key insight is that existing large corpora of open source issues and security vulnerabilities can be mined and used to learn rich semantic word embeddings. These embeddings can then be used as a feature representation to train a shallow/deep neural network to distinguish between SR and non-SR related issues. We implemented this approach, which we call SecureReqNet, using several variations of CNN architectures specialized for NLP tasks. We applied our approach to learn embeddings from a dataset combining text extracted from (i) 52,908 CVE entries, (ii) 53,214 issues extracted from the GitLab CE issue tracker and a set of prominent and diverse projects mined from GitHub, and (iii) 10,000 general articles mined from Wikipedia. We then trained the different variations of CNN architectures on a subset of these CVEs, and both security and non-security critical software issues. Finally, we evaluate the end-to-end performance of our different variations of SecureReqNet on a set of 1,032 unseen issues. Additionally, we worked with Cisco Systems, Inc. to evaluate SecureReqNet on a set of 69 requirements from a closed-source commercial software project. The results of our evaluation are promising, with the most effective variation of SecureReqNet achieving an accuracy of 96% on the set of open source issues and 71.6% on the set of industrial requirements.

In summary, this paper makes the following contributions:

• •

The design and implementation of a new technique, called SecureReqNet for automatically identifying SR issues in issue trackers using a combination of unsupervised and supervised deep learning techniques.

• •

A comprehensive evaluation of our approach on both open source issues and closed source requirements extracted from a commercial project developed by a major telecommunications company.

• •

An online appendix [5] which includes a freely available, open source implementation of our approach, pre-trained models and weights to facilitate reproducibility, and all the data111We are not able to release the commercial dataset from our industrial partner due to NDA restrictions. used to train and evaluate our approach.

II Automatically Identifying Security Related Issues

We propose SecureReqNet, a binary classifier (SR from non-SR issues) that combines neural word embeddings with adapted CNN architectures. We implemented four architecture variations of SecureReqNet via adaptions to the shape of the tensors, the size of the kernels in the convolutional layers, and the number of neurons in the fully connected layers.

II-A Learning Semantic Word Embeddings

In order to obtain a rich semantic feature space to support training our CNN supervised models, our approach learns neural word embeddings using Word2Vec [20]. Recent work [12, 7, 24] has illustrated the effectiveness of neural language models learned using the Word2Vec family of models [20].

The Word2Vec group of models uses a shallow neural network trained to predict the current word given surrounding context (i.e., the continuous bag-of-words CBOW model) or the surrounding context given the current word (i.e., the skip-gram model). Fig. 1 depicts the unsupervised network employed to vectorize the input samples (i.e., preprocessed issues) in SecureReqNet. The result is a rich, high dimensional vector space wherein each unique word in a training corpus is assigned a vector. These word vectors are concatenated to assemble a matrix. The rows indicate words in an issue description and the columns the embedding dimension. Therefore, each issue has an appropriate matrix that we use as an input sample to SecureReqNet.

II-B Adapting CNNs for NLP to Predict Security-related Issues

In this subsection we describe the four variations of SecureReqNet’s CNN architecture. We provide complete implementations of these architectures in our online appendix [5].

SecureReqNet (shallow) is based on the best architecture achieved by Han et al. [12]. This architecture establishes one convolution layer with three kernels of different shapes. Each kernel corresponds to either a 1-gram, 3-gram, or 5-gram. The kernel reduces the input matrix into a feature map. Then the feature map is reduced into one cell through max pooling. The generated cells are then flattened and converted into a vector. Each kernel generates one vector. The final tensor is a merged vector from the three vectors produced by the initial kernels. Unlike Han et al.’s SVM multi-class output layer [12], we instead utilize a binary classifier through a softmax layer.

SecureReqNet (deep) is an extension of SecureReqNet (shallow) that includes an extra convolutional layer with an extra max pooling and flattening function.

Alex-SecureReqNet (deep) is based on the proposed architecture by Krizhevsky et al. (AlexNet) [14], where 5 convolutional layers extract features and 3 fully connected layers reduce the dimensionality. We employ the standard AlexNet but adapt the final softmax layer for our binary classification.

$\alpha$-SecureReqNet (deep) modifies Alex-SecureReqNet at the convolutional layers. The modification consists of adopting the n-gram kernel strategy from Han et al. [12] which should combine the learning capacity of AlexNet with the textual context awareness provided by Han et al.’s approach. Fig. 2 provides an illustration of this architecture. The first convolutional layer has a kernel of 7-gram to reduce the input embedding matrix into 32 vector feature maps. Then, it applies a max pooling and a flattening function to derive a one column matrix. The second convolutional layer has a kernel of 5-gram followed by a max pooling and flattening function, which merges other 64 features into another column matrix. The third, fourth, and fifth convolutional layers are very similar to the original layers in AlexNet; however, these layers model kernels of 3-gram and produce 128 and 64 features for the third and fourth layers respectively. Three fully connected layers go after the last convolutional layer to reduce the dimensionality and control overfitting by means of three dropout units.

III Empirical Evaluation

To evaluate SecureReqNet, we perform an empirical evaluation with two major goals: (i) determine which CNN architecture performs the best in terms of identifying SR issues, and (ii) evaluate the effectiveness of our best performing model on datasets from different domains. The quality focus of our study is our approach’s effectiveness in terms of its ability to accurately distinguish between SR and non-SR issues. To help guide our evaluation, we formulate the following two research questions (RQs):

• •

RQ1:* Which SecureReqNet CNN architecture performs best in terms of accurately identifying SR issues?*

• •

RQ2:* How well does our best CNN model perform when identifying SR issues from both open source and industrial issue trackers?*

III-A Study Context

The context of our empirical study includes the four datasets (Embedding, Training, Validation, & Test) illustrated in Table I. These datasets are comprised of textual documents from six different sources:

CVE Database: Our CVE Dataset was derived by crawling the National Vulnerability Database (NVD) and extracting the vulnerability description for each CVE entry. In total, we extracted over 100,000 CVE descriptions, however, in order to construct a dataset balanced equally between SR and non-SR text, we randomly sampled 52,908 CVE descriptions.

GitLab Issues: To obtain a large set of diverse issues extracted from the issue trackers of a high-quality open source project we crawled the issue tracker of the GitLab Community Edition (CE) project222https://gitlab.com/gitlab-org/gitlab-ce/issues. This project contains open source components of the GitLab suite of developer tools (used by millions) with an issue tracker that includes a sophisticated labeling system. To extract SR issues, we crawled this issue tracker and extracted issue descriptions containing “security” label. To extract non-SR issues we extracted entries without the “security” label and manually verified the non-SR nature of the descriptions by randomly sampling of 10% of the issues.

GitHub Issues: Given the limited number of SR GitLab issues that we were able to extract, we also crawled the issue trackers of the most popular projects on GitHub (according to number of stars) and extracted issues with the “security” tag in order to derive a larger and more diverse dataset. Again, we randomly crawled non-SR issues and performed a random sampling to ensure the validity of the non-SR issues. We provide the full list of GitHub projects in our online appendix [5].

Wikipedia Articles: If we trained our neural embeddings on only highly specialized software text extracted from issues, we risk our model not learning more generalized word contexts that could help differentiate between SR and non-SR issues. Thus, we randomly crawled and extracted the text from 10,000 Wikipedia articles in order to bolster the generalizablility of our learned neural word embeddings.

Industrial Dataset: As part of our empirical evaluation we aim to determine whether our approach can effectively identify SRs in a set of commercial requirements extracted from a software project developed by a large telecommunications company. This dataset (labeled as “Industry” in Table I) consists of a set of users stories, 24 of which are security- or privacy- sensitive, extracted from a project under active development at Cisco Systems, Inc.. Given the more informal language utilized in these requirements, we view this dataset as a more challenging domain for our approach to generalize to, and a preliminary evaluation of its potential for commercial applicability.

The Embedding Dataset was used during the unsupervised training of the Word2Vec skip-gram model in order to derive rich embeddings for both SR and non-SR requirements. To construct the Training, Validation, and Test datasets, we split the Embedding Dataset according to a 70%/20%/10% (training/validation/test) split. Note that the training set utilizes CVE descriptions as a proxy for SR issues, as these descriptions are inherently SR and thus should provide sufficient discriminatory context for our CNN model to learn. The data split we utilized was performed with careful consideration for the type of data our approach operates upon and thus adheres to two important properties. First, we include only issues extracted from open source issue trackers (and industrial user stories) in our test set. We did not include CVE as examples of SR issues. This is because CVEs tend to have more security-specific language than SR issues, and we aim to determine if our approach trained on CVEs can generalize to the more general (or colloquial) language typically used in software issues. Second, the software issues used in our training and testing sets are temporal in nature. Thus, in a typical use case of training our model, it would not be possible to train on issues from the future to identify SR issues from the past. In fact this could provide the model with “clairvoyant” knowledge which could unfairly inflate our model’s performance. Therefore, we ensure that the issues included in the testing set are both unseen by the model, and originally created temporally after all issues in the training and validation sets to ensure a realistic experimental environment. All text was preprocessed by converting all text to lower-case, removing stop words numbers and punctuation, and performing snowball stemming.

III-B Evaluation Methodology

For our empirical evaluation, we trained the four architectures described in Sec. II-B with the Training Dataset described previously. Each input document was vectorized into a 100 dimensional embedding using the neural embedding approach described in Sec. II-A. The networks were trained using a dropout rate of $0.2$. The networks were also subject to an early stopping mechanism, which monitored the validation loss for 2,000 epochs with a patience of 100 epochs. During training, we saved the optimal model weights according to the early-stopping mechanism in addition to the final weights. We tested the optimally trained configuration of each of the four architectures on the Test Dataset described earlier. Given that we aim to differentiate the open source project issues from our set of industrial requirements, we report results for these two sources of information separately. To measure the effectiveness of our four architectures we report the accuracy (given our binary classification task), test set loss, and Area Under the Curve (AUC) computed via an ROC analysis.

IV Empirical Results

IV-A RQ1 Results: Comparing CNN Architectures

We present the results for all of our evaluation metrics in Table II. This table provides the architecture configuration, as well as pertinent hyper-parameters including the number of kernels used in the convolutional layers, the total number of model parameters (illustrating capacity), and the number of epochs required to reach optimal network capacity and optimal performance. When comparing our measured performance metrics across models, we observe that SecureReqNet (shallow) and $\alpha$-SecureReqNet tend to perform best overall, with $\alpha$-SecureReqNet achieving the best accuracy and AUC on the industrial user stories, and SecureReqNet (shallow) achieving the best loss and accuracy on the dataset of open source issues. We also observe that Alex-SecureReqNet performs quite poorly, which we attribute to its lack of n-gram context. One interesting note when comparing the results between models is that SecureReqNet (deep) achieved the lowest loss on the Industry test dataset, without a large divergence from the best accuracy reported by SecureReqNet (shallow) (0.7015 vs. 0.7164). This indicates that while SecureReqNet (shallow) achieved the best performance on our particular set of commercial user stories, we might expect SecureReqNet (deep) to exhibit more stable performance on other similar datasets. Fig. 3 illustrates training and validation loss and accuracy during the SecureReqNet (shallow) training process. We observed a test validation loss of 0.1313 and accuracy of 0.9736 compared to 0.0272 and 0.9936 for the $\alpha$-SecureReqNet respectively. Thus, we found that the shallow architecture had a better training performance through its minimization of generalization error.

IV-B RQ2 Results: Overall Performance

When examining the overall performance of our best performing architecture configurations, we find the results to be extremely promising. On our industrial set of user stories, $\alpha$-SecureReqNet achieved an accuracy of 0.7164. On our set of open source issues, SecureReqNet (shallow) achieves an impressive accuracy of 0.96. The performance of SecureReqNet (shallow) on the set of open source issues is extremely promising, as this dataset is quite diverse, and it illustrates the ability of our approach to be trained and effectively applied to unseen issues in a realistic setting.

V Related Work

V-A Automated Identification of Security Requirements

The most closely related work to the approach that we propose was conducted by Riaz et al. [22]. This approach aims to automatically identify and classify security relevant sentences in natural language requirements into one of ten objective groups for a specified domain using a k-NN classifier and a textual distance function. In contrast to this work, our approach aims to perform a binary classification on a much larger and more diverse dataset of issues in bug tracking systems into SR or non-SR categories. To effectively classify documents in such a diverse NL corpora our approach utilizes a two-phase DL technique that learns unsupervised word embeddings to train a CNN to classify issues. Additional related research has been conducted to identify security requirements from formal regulatory documents [6, 16, 21], predict severity levels with rule learning by mining defect reports [19], and identify useful information from software security documents [10]. Several studies and surveys have been conducted that examine techniques and methodologies for security requirements engineering [18, 8, 13, 17].

V-B Applications of DL to Software Engineering Tasks

Using DL to help improve automate SE tasks is becoming increasingly popular in the SE research community due to its ability to automatically identify complex features in large datasets and use these features to train effective prediction models. While a full survey of the use of DL in software engineering research is outside the scope of this paper, we review the most closely related work to our own. We adapt and build upon the work of Han et al. [12] who utilize a CNN to predict the severity of software vulnerabilities listed in the CVE database. More specifically, we adapt their CNN architecture to contain more layers, granting our network the necessary capacity to learn features from our highly diverse dataset. Chen et al. [7] utilize neural word embeddings and a CNN to help improve the proficiency of retrieving relevant results on Stack Overflow when the queries are posed in a language other than English. Xu et al. [24] utilize a similar neural language model and CNN to link similar pieces of information in Stack Overflow posts. Gu et al. [9] use an RNN encoder-decoder model to help improve the effectiveness of searching for API call sequences using natural language queries. Guo et al. [11] utilize neural word embeddings and an RNN to learn the semantics of existing trace links in a software project in order to make effective predictions for additional trace links. The advancements brought by these papers show the promise of DL in helping to classify and retrieve software artifacts, and motivate our approach.

VI Conclusion & Future Work

In this paper we have proposed a two-stage CNN approach for learning to automatically identify security-related issues in issue tracking systems. We evaluated our approach on both a large dataset of open source issues, and a smaller dataset of industrial user stories. Our approach shows promising performance, achieving high accuracy on both datasets. In the future, we aim to perform a more in-depth empirical evaluation comparing SecureReqNet to different baselines and apply our approach to help contextualize other software engineering tasks to security contexts.

Acknowledgement

This work was supported in part by a grant from the Cisco Advanced Security Research Group. Any opinions, findings, and conclusions expressed herein are the authors and do not necessarily reflect those of our sponsors.