PR-GNN: Enhancing PoC Report Recommendation with Graph Neural Network

• Published in: 2024 IEEE 40th International Conference on Data Engineering (ICDE) pp. 5629 - 5633
• Main Authors: Lu, Jiangtao, Huang, Song
• Format: Conference Proceeding
• Language: English
• Published: IEEE 13.05.2024
• Subjects: Accuracy; Codes; Data collection; Data engineering; graph neural network; graph search; Information retrieval; Soft sensors; Supply chains; vulnerability PoC report
• ISSN: 2375-026X
• DOI: 10.1109/ICDE60146.2024.00451

There has been a growing number of software supply chain vulnerabilities disclosed annually, posing increasingly formidable challenges to vulnerability validation. Timely validation plays a critical role in mitigating the security risks across the entire software supply chain. Whenever a new vulnerability is disclosed, it may be difficult to generate a corresponding PoC for verification in a short time. Expediting the validation process can be achieved through reference to similar PoC reports, potentially reducing this time. Retrieving similar PoC reports manually is labor-intensive and time-consuming due to their distributed nature across different data sources. Moreover, PoC reports encompass diverse trigger methods, including code, instruction, and action. There is a limitation in the current modeling of different types of trigger methods in PoC reports, as it mainly focuses only on code-based trigger methods while disregarding other types of trigger methods. To tackle the issues, this Ph.D. research uses graph-based method to model all types of PoC and proposes a PoC report recommendation model utilizing graph neural network (PR-GNN) to provide related PoC reports when facing a new vulnerability. In this work, a collection of heterogeneous PoC reports from various sources is assembled and modeled as PoC heterogeneous graphs. PR-GNN accurately measures similarity by incorporating graph-level embedding comparison and fine-grained comparison of trigger method type nodes. To our knowledge, this research represents the first attempt to provide more accurate and efficient recommendations for PoC reports to assist security professionals in timely vulnerability verification and maintaining software supply chain security.