Abstract:The security guarantee of AI-enabled software systems (particularly using deep learning techniques as a functional core) is pivotal against the adversarial attacks exploiting software vulnerabilities. However, little attention has been paid to a systematic investigation of vulnerabilities in such systems. A common situation learned from the open source software community is that deep learning engineers frequently integrate off-the-shelf or open-source learning frameworks into their ecosystems. In this work, we specifically look into deep learning (DL) framework and perform the first systematic study of vulnerabilities in DL systems through a comprehensive analysis of identified vulnerabilities from Common Vulnerabilities and Exposures (CVE) and open-source DL tools, including TensorFlow, Caffe, OpenCV, Keras, and PyTorch. We propose a two-stream data analysis framework to explore vulnerability patterns from various databases. We investigate the unique DL frameworks and libraries development ecosystems that appear to be decentralized and fragmented. By revisiting the Common Weakness Enumeration (CWE) List, which provides the traditional software vulnerability related practices, we observed that it is more challenging to detect and fix the vulnerabilities throughout the DL systems lifecycle. Moreover, we conducted a large-scale empirical study of 3,049 DL vulnerabilities to better understand the patterns of vulnerability and the challenges in fixing them. We have released the full replication package at <a class="link-external link-https" href="https://github.com/codelzz/Vulnerabilities4DLSystem" rel="external noopener nofollow">this https URL</a>. We anticipate that our study can advance the development of secure DL systems.

A Multi-Dimension Vulnerability Analysis Framework for Large-Scale Distributed System

Vulnerability Assessment of Electrical Cyber-Physical Systems Against Cyber Attacks

Vulnerability Analysis of Electrical Cyber Physical Systems Using a Simulation Platform.

Vulnerability Detection For Smart Grid Devices Via Static Analysis

Vulnerability Assessment for Cyber Physical System of Distribution Network in Distributed Cooperative Control Mode

A Large-Scale Empirical Study on Vulnerability Distribution Within Projects and the Lessons Learned

Research on the Architecture of Vulnerability Discovery Technology

Vulnerability Correlation, Multi-step Attack and Exploit Chain in Breach and Attack Simulation

Risk Based Vulnerability Assessment for Hvdc Transmission System

A Software Vulnerability Analysis Environment Based on Virtualization Technology

Structural Vulnerability Analysis of Large Power Grid Based on Complex Network Theory

On Security Weaknesses and Vulnerabilities in Deep Learning Systems

Current Status and Perspective of Vulnerability Assessment of Cyber-Physical Power Systems Based on Complex Network Theory

Systemic Risk and Vulnerability Analysis of Multi-cloud Environments

Survey on Software Vulnerability Analysis Method Based on Machine Learning.

Towards A Structured Model for Software Vulnerabilities

An Emulation Environment for Vulnerability Analysis of Large-Scale Distributed System

Vulnerability Analysis for Complex Networks Using Aggressive Abstraction

Context and Multi-Features-Based Vulnerability Detection: A Vulnerability Detection Frame Based on Context Slicing and Multi-Features

Modelization and analysis of dynamic heterogeneous redundant system

Vulnerability assessment of cyber-physical power system considering virtual cyber-physical connections