Update README.md
Browse files
README.md
CHANGED
@@ -1,57 +1,83 @@
|
|
1 |
---
|
|
|
|
|
|
|
2 |
library_name: transformers
|
3 |
-
base_model: microsoft/codebert-base
|
4 |
tags:
|
5 |
-
-
|
6 |
-
|
7 |
-
-
|
8 |
-
|
|
|
9 |
---
|
10 |
|
11 |
-
|
12 |
-
should probably proofread and complete it, then remove this comment. -->
|
13 |
|
14 |
-
|
15 |
|
16 |
-
|
17 |
-
It achieves the following results on the evaluation set:
|
18 |
-
- Loss: 0.0000
|
19 |
|
20 |
-
|
21 |
|
22 |
-
|
23 |
|
24 |
-
## Intended
|
25 |
|
26 |
-
|
27 |
|
28 |
-
|
|
|
|
|
|
|
29 |
|
30 |
-
|
31 |
|
32 |
-
|
33 |
|
34 |
-
|
|
|
35 |
|
36 |
-
|
37 |
-
|
38 |
-
- train_batch_size: 8
|
39 |
-
- eval_batch_size: 8
|
40 |
-
- seed: 42
|
41 |
-
- optimizer: Use OptimizerNames.ADAMW_TORCH_FUSED with betas=(0.9,0.999) and epsilon=1e-08 and optimizer_args=No additional optimizer arguments
|
42 |
-
- lr_scheduler_type: linear
|
43 |
-
- num_epochs: 1
|
44 |
|
45 |
-
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
46 |
|
47 |
-
|
48 |
-
|
49 |
-
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
50 |
|
|
|
|
|
51 |
|
52 |
-
|
|
|
53 |
|
54 |
-
|
55 |
-
|
56 |
-
- Datasets 4.0.0
|
57 |
-
- Tokenizers 0.22.0
|
|
|
1 |
---
|
2 |
+
license: mit
|
3 |
+
language:
|
4 |
+
- code
|
5 |
library_name: transformers
|
|
|
6 |
tags:
|
7 |
+
- text-classification
|
8 |
+
- code-classification
|
9 |
+
- vulnerability-detection
|
10 |
+
- automatic-vulnerability-detection
|
11 |
+
- secure-coding
|
12 |
---
|
13 |
|
14 |
+
# Vulnerability Detector for C Code (SARD)
|
|
|
15 |
|
16 |
+
This model is a fine-tuned version of `microsoft/codebert-base` designed to detect vulnerabilities in C source code functions. It was developed as a submission for the AI Grand Challenge (PS-1).
|
17 |
|
18 |
+
## Model Description
|
|
|
|
|
19 |
|
20 |
+
This is a binary text-classification model that takes a C function as input and classifies it as either **Vulnerable** (`LABEL_1`) or **Safe** (`LABEL_0`).
|
21 |
|
22 |
+
The model was specifically fine-tuned on the [NIST SARD (Software Assurance Reference Dataset)](https://samate.nist.gov/SARD/), focusing on common C vulnerabilities like Memory Leaks, Buffer Overflows, and other CWEs present in the Juliet Test Suite. Due to the clean and structured nature of the SARD dataset, the model achieved a very high accuracy on the validation set.
|
23 |
|
24 |
+
## Intended Uses & Limitations
|
25 |
|
26 |
+
This model is intended as a proof-of-concept tool to assist developers in identifying potentially vulnerable code patterns during the development lifecycle.
|
27 |
|
28 |
+
**Limitations:**
|
29 |
+
* The model is highly specialized for the types of vulnerabilities found in the SARD dataset. Its performance on real-world, messy, or obfuscated code may be lower.
|
30 |
+
* It should be used as an assistive tool, not as a replacement for comprehensive security audits or other static analysis tools.
|
31 |
+
* The model classifies entire functions and may not pinpoint the exact line of code responsible for the vulnerability.
|
32 |
|
33 |
+
## How to Use
|
34 |
|
35 |
+
The model can be easily used with the `transformers` library `pipeline`.
|
36 |
|
37 |
+
```python
|
38 |
+
from transformers import pipeline
|
39 |
|
40 |
+
# Load the classifier pipeline
|
41 |
+
classifier = pipeline("text-classification", model="jacpacd/vuln-detector-codebert-c-sard")
|
|
|
|
|
|
|
|
|
|
|
|
|
42 |
|
43 |
+
# Example of a vulnerable C function (Memory Leak)
|
44 |
+
vulnerable_code = """
|
45 |
+
void CWE401_Memory_Leak__strdup_char_01_bad()
|
46 |
+
{
|
47 |
+
char * data;
|
48 |
+
data = NULL;
|
49 |
+
{
|
50 |
+
char myString[] = "myString";
|
51 |
+
/* POTENTIAL FLAW: Allocate memory from the heap */
|
52 |
+
data = strdup(myString);
|
53 |
+
printLine(data);
|
54 |
+
}
|
55 |
+
/* POTENTIAL FLAW: No deallocation of memory */
|
56 |
+
;
|
57 |
+
}
|
58 |
+
"""
|
59 |
|
60 |
+
# Example of a safe C function
|
61 |
+
safe_code = """
|
62 |
+
void CWE401_Memory_Leak__strdup_char_01_goodB2G()
|
63 |
+
{
|
64 |
+
char * data;
|
65 |
+
data = NULL;
|
66 |
+
{
|
67 |
+
char myString[] = "myString";
|
68 |
+
data = strdup(myString);
|
69 |
+
printLine(data);
|
70 |
+
}
|
71 |
+
/* FIX: Deallocate memory */
|
72 |
+
free(data);
|
73 |
+
}
|
74 |
+
"""
|
75 |
|
76 |
+
results_vuln = classifier(vulnerable_code)
|
77 |
+
results_safe = classifier(safe_code)
|
78 |
|
79 |
+
print(f"Vulnerable Code Prediction: {results_vuln[0]}")
|
80 |
+
# Expected output: {'label': 'LABEL_1', 'score': 0.99...}
|
81 |
|
82 |
+
print(f"Safe Code Prediction: {results_safe[0]}")
|
83 |
+
# Expected output: {'label': 'LABEL_0', 'score': 0.99...}
|
|
|
|