puya-pakshad / vulnerabilitydataset

A dataset of datasets for vulnerability assessment and program analysis

VulnerabilityDataset

This is a repository of datasets used to detect security vulnerabilities and types of vulnerabilities at the function level. In the excel-file titled "Main_DataSet", the record number of 15181 rows extracted from source-code of six real projects (OpenSSL, SQLite, libxslt, FreeType, LibTiff, and Binutils) is prepared at the function level. Overally, This dataset includes 49,599 records, each of which specifies the information of a function of 10 projects. Moreover, there are 275 vulnerable functions in this dataset. So Out Vulnerability dataset1 of source code extracted from 10 real projects (OpenSSL, SQLite, FreeType, LibTiff, Libxslt, Binutils, FFmpeg, ImageMagick, OpenSC, and rdesktop) was prepared for the first time that can be used publicly by security experts for further studies. Also, the attack type of each function (each row) is also specified. Each row represents information related to one function of the program. The rest of the files are 8 datasets that are produced in a balanced format (vulnerable / non-vulnerable) from the "Main_DataSet" used for the machine learning model.

Some pseudo-code snippets to calculate security metrics

pseudocode [Joern][4.3.4] as an implemented code snippet is also uploaded among the files. pseudocode of security metrics are as follows: M1:

queryNodeIndex("functionId:(id1 id2 idN) AND isCFGNode:True").as("x").outE("FLOWS_TO").id.as("y").select{it.functionId}{it}.groupBy{it[0]}{it[1]}{it.size()}.cap
queryNodeIndex("functionId:(id1 id2 idN) AND isCFGNode:True").functionId.groupCount().cap

M2:

queryNodeIndex("functionId:(id1 id2 idN) AND type:(ForStatement WhileStatement DoStatement)").groupBy{it.functionId}{it.id}.cap

M3:

queryNodeIndex("functionId:(id1 id2 idN) AND type:(ForStatement WhileStatement DoStatement)").groupBy{it.functionId}{it.id}.cap

M4:

queryNodeIndex('functionId:(*) AND type:(ForStatement WhileStatement DoStatement)').groupBy{it.functionId}{it.id}.as('x').astNodes().children().as('y').filter{it.type == 'ForStatement' || it.type == 'WhileStatement' || it.type == 'DoStatement'}.select{it}{it}.groupBy{it[0]}{it[1]} 

M5:

queryNodeIndex('functionId:(*) AND type:Parameter')

M6:

queryNodeIndex('functionId:(*) AND type:Callee').as('x').parents().astNodes().children().as('y').filter{it.type == 'Argument'}.select{it}{it}
queryNodeIndex('type: Function')

M7:

queryNodeIndex('functionId:(*) AND type:PtrMemberAccess').dedup
queryNodeIndex('functionId:(*) AND type:UnaryOperator').filter{it.code=='*'}.dedup
queryNodeIndex('functionId:(*) AND type:(UnaryExpression IncDecOp)').dedup.groupBy{it.functionId}{it.code}

M8:

queryNodeIndex('functionId:(*) AND type:PtrMemberAccess').out('USE').dedup.groupBy{it.functionId}{it.code}
queryNodeIndex('functionId:(*) AND type:UnaryOp').as('op').children().filter{it.type=='UnaryOperator' && it.code=='&'}.back('op').astNodes().filter{it.type=='Identifier'}.code.as('sys').dedup.select

M9:

queryNodeIndex('functionId:(*) AND type:UnaryOp').as('here').children().filter{it.type=='UnaryOperator' && it.code=='*'}.back('here').out('USE').groupBy{it.functionId}{it.code}.dedup

M10:

OR(queryNodeIndex('functionId:(*) AND type:Condition').in('IS_AST_PARENT'),queryNodeIndex('functionId:%s AND type:ForStatement')).dedup().groupBy{it.functionId}{it.id}.as('x').astNodes().children().as('y').filter{it.type == 'SwitchStatement' ||it.type == 'ForStatement' || it.type == 'WhileStatement' || it.type == 'DoStatement' || it.type == 'IfStatement'}.select{it.id}{it.id}.groupBy{it[0]}{it[1]}
OR(queryNodeIndex('functionId:(*) AND type:Condition').in('IS_AST_PARENT'),queryNodeIndex('functionId:%s AND type:ForStatement')).dedup().groupBy{it.functionId}{it.id}.as('x').astNodes().children().as('y').filter{it.type == 'SwitchStatement' ||it.type == 'ForStatement' || it.type == 'WhileStatement' || it.type == 'DoStatement' || it.type == 'IfStatement'}.select{it.functionId}{it.id}.groupBy{it[0]}{it[1]}

M11:

OR(queryNodeIndex('functionId:(*) AND type:Condition').in('IS_AST_PARENT'),queryNodeIndex('functionId:%s AND type:ForStatement')).dedup().groupBy{it.functionId}{it.id}.as('x').astNodes().children().as('y').filter{it.type == 'SwitchStatement' ||it.type == 'ForStatement' || it.type == 'WhileStatement' || it.type == 'DoStatement' || it.type == 'IfStatement'}.select{[it.functionId,it.id]}{it.id}.groupBy{it[0]}{it[1]}

M12:

queryNodeIndex('functionId:(*) AND type:Condition AND isCFGNode:True').as('x').outE('CONTROLS').as('y').select{[it.id,it.code,it.functionId]}{it}.groupBy{it[0]}{it[1]}

M13:

getNodesWithType('Condition').as('x').select{[it.id,it.functionId]}
queryNodeIndex('functionId:(*) AND isCFGNode:True').as('x').outE('REACHES').as('y').select{it}{it}.groupBy{it[0]}{it[1]}
queryNodeIndex('functionId:(*) AND type:IdentifierDeclStatement').as('x').uses()
queryNodeIndex('functionId:(*) AND type:IdentifierDeclStatement').as('x').defines()

M14:

queryNodeIndex('functionId:(*) AND type:Condition').parents().filter{it.type=='IfStatement'}.as('x').ithChildren('0').as('y').select{it}{it}

M15:

queryNodeIndex('functionId:(*) AND isCFGNode:True').as('x').outE('REACHES').as('y').select{it}{it.property('var')}
getNodesWithType('Condition').astNodes().filter{it.type=='Identifier'}