Abstract:Traditional vulnerability detection methods have limitations due to their need for extensive manual labor. Using automated means for vulnerability detection has attracted research interest, especially deep learning, which has achieved remarkable results. Since graphs can better convey the structural feature of code than text, graph neural network (GNN) based vulnerability detection is significantly better than text-based approaches. Therefore, GNN-based vulnerability detection approaches are becoming popular. However, GNN models are close to black boxes for security analysts, so the models cannot provide clear evidence to explain why a code sample is detected as vulnerable or secure. At this stage, many GNN interpreters have been proposed. However, the explanations provided by these interpretations for vulnerability detection models are highly inconsistent and unconvincing to security experts. To address the above issues, we propose principled guidelines to assess the quality of the interpretation approaches for GNN-based vulnerability detectors based on concerns in vulnerability detection, namely, stability, robustness, and effectiveness. We conduct extensive experiments to evaluate the interpretation performance of six famous interpreters ( GNN-LRP , DeepLIFT , GradCAM , GNNExplainer , PGExplainer , and SubGraphX ) on four vulnerability detectors ( DeepWukong , Devign , IVDetect , and Reveal ). The experimental results show that the target interpreters achieve poor performance in terms of effectiveness, stability, and robustness. For effectiveness, we find that the instance-independent methods outperform others due to their deep insight into the detection model. In terms of stability, the perturbation-based interpretation methods are more resilient to slight changes in model parameters as they are model-agnostic. For robustness, the instance-independent approaches provide more consistent interpretation results for similar vulnerabilities.

Interpreting GNN-based IDS Detections Using Provenance Graph Structural Features

Explanatory subgraph attacks against Graph Neural Networks

Explainable Graph Neural Networks Under Fire

Jointly Attacking Graph Neural Network and its Explanations

Interpretability Evaluation of Botnet Detection Model Based on Graph Neural Network

Interpreters for GNN-Based Vulnerability Detection: Are We There Yet?

Robust explanations for graph neural network with neuron explanation component

Graph Neural Networks for Vulnerability Detection: A Counterfactual Explanation

APT-KGL: an Intelligent APT Detection System Based on Threat Knowledge and Heterogeneous Provenance Graph Learning

Explaining Network Intrusion Detection System Using Explainable AI Framework

Coca: Improving and Explaining Graph Neural Network-Based Vulnerability Detection Systems

User-friendly, Interactive, and Configurable Explanations for Graph Neural Networks with Graph Views

XInsight: Revealing Model Insights for GNNs with Flow-based Explanations

X-CBA: Explainability Aided CatBoosted Anomal-E for Intrusion Detection System

Identifying Backdoored Graphs in Graph Neural Network Training: An Explanation-Based Approach with Novel Metrics

Explainable Malware Detection through Integrated Graph Reduction and Learning Techniques

ProtGNN: Towards Self-Explaining Graph Neural Networks.

Reliable Graph Neural Network Explanations Through Adversarial Training

View-based Explanations for Graph Neural Networks

Towards Inductive and Efficient Explanations for Graph Neural Networks

GraphFramEx: Towards Systematic Evaluation of Explainability Methods for Graph Neural Networks