Vulnerability Detection for Open Source Components in Smart Power Grid

Open-source components (OSCs) are extensively utilized in smart power grids. However, the deployment of OSCs often lacks proper management and updates, thereby posing security threats to the supply chain. Current techniques for analyzing OSCs suffer from high false positives and limited practicality. To address these issues, we propose a vulnerability detection scheme named Trace2Vec for OSCs in smart power grids. Initially, we collect and analyze crash reports caused by vulnerabilities in OSCs from various popular crash reporting systems. Subsequently, we design a method to convert software backtraces into unique vector representations. Based on these representations, we build a classifier to identify bugs in open-source components. To evaluate the effectiveness and superiority of our approach, we construct a large-scale dataset of crash reports by comprehensively gathering data from several popular open-source software platforms. Additionally, we conduct experiments on two existing datasets. Our experimental results demonstrate the high effectiveness of the Trace2Vec scheme in detecting vulnerabilities and its superiority over state-of-the-art schemes.