Abstract:Vulnerability detection is essential to protect software systems. Various approaches based on deep learning have been proposed to learn the pattern of vulnerabilities and identify them. Although these approaches have shown vast potential in this task, they still suffer from the following issues: (1) It is difficult for them to distinguish vulnerability-related information from a large amount of irrelevant information, which hinders their effectiveness in capturing vulnerability features. (2) They are less effective in handling long code because many neural models would limit the input length, which hinders their ability to represent the long vulnerable code snippets. To mitigate these two issues, in this work, we proposed to decompose the syntax-based Control Flow Graph (CFG) of the code snippet into multiple execution paths to detect the vulnerability. Specifically, given a code snippet, we first build its CFG based on its Abstract Syntax Tree (AST), refer to such CFG as syntax-based CFG, and decompose the CFG into multiple paths from an entry node to its exit node. Next, we adopt a pre-trained code model and a convolutional neural network to learn the path representations with intra- and inter-path attention. The feature vectors of the paths are combined as the representation of the code snippet and fed into the classifier to detect the vulnerability. Decomposing the code snippet into multiple paths can filter out some redundant information unrelated to the vulnerability and help the model focus on the vulnerability features. Besides, since the decomposed paths are usually shorter than the code snippet, the information located in the tail of the long code is more likely to be processed and learned. To evaluate the effectiveness of our model, we build a dataset with over 231k code snippets, in which there are 24k vulnerabilities. Experimental results demonstrate that the proposed approach outperforms state-of-the-art baselines by at least 22.30%, 42.92%, and 32.58% in terms of Precision, Recall, and F1-Score, respectively. Our further analysis investigates the reason for the proposed approach's superiority.

Vulnerability Detection for Source Code Using Contextual LSTM

Function-Level Vulnerability Detection Through Fusing Multi-Modal Knowledge

Context and Multi-Features-Based Vulnerability Detection: A Vulnerability Detection Frame Based on Context Slicing and Multi-Features

FTCLNet: Convolutional LSTM with Fourier Transform for Vulnerability Detection

Vulnerability Detection in C/C++ Code with Deep Learning

Vulnerability Detection by Learning from Syntax-Based Execution Paths of Code

Graph Confident Learning for Software Vulnerability Detection

VulCNN

A novel approach for software vulnerability detection based on intelligent cognitive computing

A Comparative Study of Deep Learning-Based Vulnerability Detection System

Automated Vulnerability Detection in Source Code Using Minimum Intermediate Representation Learning

Automated software vulnerability detection with machine learning

Statement-Level Vulnerability Detection: Learning Vulnerability Patterns Through Information Theory and Contrastive Learning

An empirical study of text-based machine learning models for vulnerability detection

Multi-context Attention Fusion Neural Network for Software Vulnerability Identification

BEDetector: A Two-Channel Encoding Method to Detect Vulnerabilities Based on Binary Similarity

Software Vulnerability Mining and Analysis Based on Deep Learning

Vulnerability Detection Using Two-Stage Deep Learning Models

Path-sensitive Code Embedding Via Contrastive Learning for Software Vulnerability Detection

Context-based statement-level vulnerability localization

MSGVUL: Multi-semantic integration vulnerability detection based on relational graph convolutional neural networks