基于深度学习的安全缺陷报告预测方法实证研究

软件安全问题的发生在大多数情况下会造成非常严重的后果，及早发现安全问题，是预防安全事故的关键手段之一.安全缺陷报告预测可以辅助开发人员及早发现被测软件中潜藏的安全缺陷，从而尽早得以修复.然而，由于安全缺陷在实际项目中的数量较少，而且特征复杂（即安全缺陷类型繁多，不同类型安全缺陷特征差异性较大），这使得手工提取特征相对困难，并随后造成传统机器学习分类算法在安全缺陷报告预测性能方面存在一定的瓶颈.针对该问题，提出基于深度学习的安全缺陷报告预测方法，采用深度文本挖掘模型TextCNN和TextRNN构建安全缺陷报告预测模型；针对安全缺陷报告文本特征，使用skip-grams方式构建词嵌入矩阵，并借助注意力机制对TextRNN模型进行优化.所构建的模型在5个不同规模的安全缺陷报告数据集上展开了大规模实证研究，实证结果表明：深度学习模型在80%的实验案例中都要优于传统机器学习分类算法，性能指标F1-score平均可提升0.258，在最好的情况下甚至可以提升0.535.除此之外，针对安全缺陷报告数据集存在的类不均衡问题，对不同采样方法进行了实证研究，并对结果进行了分析.     

OpenSSL Heartbleed漏洞研究及启示

2014年4月8日,OpenSSL爆出其加密代码中一种名为Heartbleed的严重安全漏洞。利用该漏洞,攻击者在对客户端OpenSSL代码进行修改后,就能从内存中读取请求存储位置之外的多达64 KB的数据,这段内存数据可能包含证书私钥、用户名与密码、聊天信息、电子邮件、重要的商业文档、通信等数据。目前,绝大多数的电商以及网络支付的登录服务都是使用OpenSSL协议进行搭建的,所以该漏洞有着极为深远的影响。因此第一时间对该漏洞进行研究,分析,修复,是整个安全领域的首要任务。     

Attraction of Male European Tarnished Plant Bug, <Emphasis Type="Italic">Lygus rugulipennis</Emphasis> to Components of the Female Sex Pheromone in the Field

Previous work showed that females of the European tarnished plant bug, Lygus rugulipennis Poppius (Heteroptera: Miridae), produced three chemicals, hexyl butyrate, (E)-2-hexenyl butyrate, and (E)-4-oxo-2-hexenal, and that these were suspected to be components of the female sex pheromone. In field experiments, traps baited with blends of these chemicals dispensed from polyethylene vials and sachets failed to catch significant numbers of males. Here, we report more recent field experiments in which the chemicals were released from glass microcapillary tubes. A blend of hexyl butyrate and (E)-4-oxo-2-hexenal was significantly attractive to male L. rugulipennis. In addition, whereas the mixture of all three components attracted fewer L. rugulipennis males, this tertiary blend captured significantly greater numbers of males of the congeneric species Lygus pratensis than the binary mixture. The possible reasons for the success of the microcapillaries compared with other dispensers are discussed.     

嵌入式软件静态测试技术研究

针对嵌入式系统软件的特点,就嵌入式软件静态测试需要解决的关键技术问题进行研究。提出嵌入式软件的代码整理、静态分析和代码bug检测的实现方法,并在基于ARM的嵌入式软件宿主环境测试平台ARM-TestV1.0上测试实现。测试结果表明,所提出的嵌入式软件静态测试方法行之有效。     

一种针对格式文件的符号执行优化方法

为了解决符号执行中路径爆炸、新路径发现率低等问题，提出了针对文件格式数据块约束的符号执行分析方法（FFCBSE，File Format Constraint Based Symbolic Execution）优化框架.文件格式信息的缺失会影响符号执行的效率以及测试用例生成，该方法通过分析程序代码自动分析程序读取的格式文件数据块之间的依赖关系并建立相关约束，随后使用这些约束引导符号执行更关注于核心功能代码区域.在KLEE中实现了上述优化框架，并对Tcpdump、Readelf、Elfdump、File、Zlib等7个常用文件处理程序做了检测.和KLEE以及DASE相比，FFCBSE发现了13个之前未知的缺陷，在指令覆盖率和分支覆盖率有10%~225%不同程度的提升.     

Growth Inhibition of Bacteria by Salsa Mexicana

ABSTRACT: Antimicrobial activity of salsa mexicana against Escherichia coli, Klebsiella pneumoniae, Bacillus subtilis, Bacillus cereus, Staphylococcus aureus , and Saccharomyces cerevisiae was studied. The pressed salsa juice suppressed completely the growth of E. coli, B. subtilis , and S. aureus. K. pneumoniae and B. cereus were suppressed partly but Saccharomyces cerevisiae was not suppressed at all by the juice. Three types of microbicidal or microbiostatic components have been found: (1) H⁺, (2) volatile compounds, and (3) non-ionized carboxylic acids or analogous compounds. It is proposed that the supplementation of stink bugs in the salsa seen widely in the south of Mexico is used to intensify the herbal odor of the salsa.     

“心脏出血”漏洞引发的思考

＂心脏出血＂漏洞引起了全球对信息安全的广泛讨论。本文从安全经济学、安全机制、开源安全性和国家安全出发,多角度地对此次事件进行思考和讨论,揭示出信息安全作是一项系统工程,我们不仅要关注技术层面,更需要关注安全事件背后反映出来的深层次问题。     

Sex pheromone of the mullein bug,Campylomma verbasci (Meyer) (Heteroptera: Miridae)

The first known sex pheromone for the family Miridae is reported for the mullein bug,Campylomma verbasci (Meyer) (Heteroptera: Miridae). Extracts of and Porapak Q-trapped volatiles from females were attractive to males in field bioassays. Butyl butyrate and hexyl butyrate were the predominant compounds in the females' volatiles, but these compounds previously had been found to be inactive when released alone or in combination. Butyl butyrate in combination with an isolated trace chemical, (E)-crotyl butyrate (which was inactive alone), rivaled the attraction elicited by five live females. When synthetic butyl butyrate and (E)-crotyl butyrate in a 16: 1 ratio were released at 91 or 183 g/day, they comprised an effective attractant for male bugs.     

Novel components from secretory hairs of azalea lace bugStephanitis pyrioides (Hemiptera: Tingidae)

The azalea lace bug secretes a clear fluid from secretory setae on the antennae and globulated spines on the dorsal and lateral aspects of the abdomen. The secretion contains 2-alkyl-5-hydroxychromones, the corresponding chromanones and diketones, and straight-chain aldehydes and ketones.     

Identification of the Airborne Aggregation Pheromone of the Common Bed Bug, <Emphasis Type="Italic">Cimex lectularius</Emphasis>

Adults and juveniles of the common bed bug, Cimex lectularius L. (Hemiptera: Cimicidae), return to and aggregate in harborages after foraging for hosts. We tested the hypothesis that the aggregation is mediated, in part, by an airborne aggregation pheromone. Volatiles from experimental C. lectularius harborages were captured on Porapak Q, fractionated by liquid chromatography, and bioassayed in dual-choice, still-air olfactometer experiments. Of 14 compounds with >100 pg abundance in gas chromatography-mass spectrometry analyses of two bioactive fractions, 10 compounds [nonanal, decanal, (E)-2-hexenal, (E)-2-octenal, (2E,4E)-octadienal, benzaldehyde, (+)- and (-)-limonene, sulcatone, benzyl alcohol] proved to be essential components of the C. lectularius airborne aggregation pheromone.