Over the last years, software development in domains with high security
demands transitioned from traditional methodologies to uniting modern
approaches from software development and operations (DevOps). Key principles of
DevOps gained more importance and are now applied to security aspects of
software development, resulting in the automation of security-enhancing
activities. In particular, it is common practice to use automated security
testing tools that generate reports after inspecting a software artifact from
multiple perspectives. However, this raises the challenge of generating
duplicate security findings. To identify these duplicate findings manually, a
security expert has to invest resources like time, effort, and knowledge. A
partial automation of this process could reduce the analysis effort, encourage
DevOps principles, and diminish the chance of human error. In this study, we
investigated the potential of applying Natural Language Processing for
clustering semantically similar security findings to support the identification
of problem-specific duplicate findings. Towards this goal, we developed a web
application for annotating and assessing security testing tool reports and
published a human-annotated corpus of clustered security findings. In addition,
we performed a comparison of different semantic similarity techniques for
automatically grouping security findings. Finally, we assess the resulting
clusters using both quantitative and qualitative evaluation methods.

本研究旨在使用自然语言处理技术对安全测试工具报告中的安全问题进行聚类，以便更好地发现问题特定的重复发现。通过开发一个 Web 应用程序进行注释和评估安全测试工具报告的人类注释语料库，并使用自动分组安全发现的不同语义相似性技术进行比较。最终进行了定量和定性方法的评估结果。

基于语义相似性的安全测试工具结果聚类

Semantic Similarity-Based Clustering of Findings From Security Testing Tools

Due to the increasing deployment of Deep Neural Networks (DNNs) in real-world
security-critical domains including autonomous vehicles and collision avoidance
systems, formally checking security properties of DNNs, especially under
different attacker capabilities, is becoming crucial. Most existing security
testing techniques for DNNs try to find adversarial examples without providing
any formal security guarantees about the non-existence of such adversarial
examples. Recently, several projects have used different types of
Satisfiability Modulo Theory (SMT) solvers to formally check security
properties of DNNs. However, all of these approaches are limited by the high
overhead caused by the solver.
In this paper, we present a new direction for formally checking security
properties of DNNs without using SMT solvers. Instead, we leverage interval
arithmetic to compute rigorous bounds on the DNN outputs. Our approach, unlike
existing solver-based approaches, is easily parallelizable. We further present
symbolic interval analysis along with several other optimizations to minimize
overestimations of output bounds.
We design, implement, and evaluate our approach as part of ReluVal, a system
for formally checking security properties of Relu-based DNNs. Our extensive
empirical results show that ReluVal outperforms Reluplex, a state-of-the-art
solver-based system, by 200 times on average. On a single 8-core machine
without GPUs, within 4 hours, ReluVal is able to verify a security property
that Reluplex deemed inconclusive due to timeout after running for more than 5
days. Our experiments demonstrate that symbolic interval analysis is a
promising new direction towards rigorously analyzing different security
properties of DNNs.

利用区间算法和符号区间分析代替 SMT solver，可以更高效地实现对 DNN 的安全性质进行正式验证，ReluVal 系统相比现有最先进的 solver-based 系统 Reluplex，平均可以提升 200 倍验证效率。