On the Effectiveness of Function-Level Vulnerability Detectors for Inter-Procedural Vulnerabilities

Zhen Li,Ning Wang,Deqing Zou,Yating Li,Ruqian Zhang,Shouhuai Xu,Chao Zhang,Hai Jin

2024-01-20

Abstract:Software vulnerabilities are a major cyber threat and it is important to detect them. One important approach to detecting vulnerabilities is to use deep learning while treating a program function as a whole, known as function-level vulnerability detectors. However, the limitation of this approach is not understood. In this paper, we investigate its limitation in detecting one class of vulnerabilities known as inter-procedural vulnerabilities, where the to-be-patched statements and the vulnerability-triggering statements belong to different functions. For this purpose, we create the first Inter-Procedural Vulnerability Dataset (InterPVD) based on C/C++ open-source software, and we propose a tool dubbed VulTrigger for identifying vulnerability-triggering statements across functions. Experimental results show that VulTrigger can effectively identify vulnerability-triggering statements and inter-procedural vulnerabilities. Our findings include: (i) inter-procedural vulnerabilities are prevalent with an average of 2.8 inter-procedural layers; and (ii) function-level vulnerability detectors are much less effective in detecting to-be-patched functions of inter-procedural vulnerabilities than detecting their counterparts of intra-procedural vulnerabilities.

Cryptography and Security,Software Engineering

What problem does this paper attempt to address?

### Problems the Paper Attempts to Solve

This paper primarily explores the effectiveness of function-level vulnerability detectors in detecting inter-procedural vulnerabilities. Specifically:

1. **Background and Motivation**:
- Software vulnerabilities are one of the major cybersecurity threats, and existing Static Application Security Testing (SAST) tools have high false positive and false negative rates in vulnerability detection.
- Deep learning methods have been used to improve vulnerability detection, one of which is encoding program functions as a whole, known as function-level vulnerability detectors.
- Function-level vulnerability detectors perform well in detecting intra-procedural vulnerabilities, but their limitations in detecting inter-procedural vulnerabilities are not yet clear.

2. **Research Objectives**:
- To explore the effectiveness of function-level vulnerability detectors in detecting inter-procedural vulnerabilities.
- To analyze the prevalence and detection difficulty of inter-procedural vulnerabilities and propose corresponding solutions.

3. **Main Contributions**:
- Proposed a new tool, VulTrigger, for automatically identifying trigger statements in known vulnerabilities.
- Constructed the first inter-procedural vulnerability dataset (InterPVD), based on C/C++ open-source software.
- Experimental results show that VulTrigger significantly outperforms existing SAST tools and other methods in identifying inter-procedural vulnerabilities.
- Experiments reveal that function-level vulnerability detectors perform poorly in detecting trigger functions of inter-procedural vulnerabilities, especially when it comes to detecting functions that need to be patched.

Through this research, the paper reveals the issues function-level vulnerability detectors face in handling inter-procedural vulnerabilities and proposes directions for improvement.