论文标题
语句级漏洞检测：通过信息理论和对比度学习学习漏洞模式
Statement-Level Vulnerability Detection: Learning Vulnerability Patterns Through Information Theory and Contrastive Learning
论文作者
论文摘要
软件漏洞是一个严重和关键的问题。通常，在由数百或数千个源代码语句组成的程序或功能中，只有少数语句引起相应的漏洞。在机器学习工具的帮助下，专家在功能或程序级别上完成了大多数脆弱性标签的方法。将这种方法扩展到代码语句级别的成本要高得多且耗时，并且仍然是一个开放的问题。在本文中，我们提出了一种新颖的端到端深度学习方法，以识别与特定功能相关的脆弱性代码语句。受到现实世界中脆弱代码中观察到的特定结构的启发，我们首先利用相互信息来学习一组潜在变量，这些变量代表了源代码语句与相应函数的漏洞的相关性。然后，我们提出了新颖的群集空间对比学习，以进一步改善与脆弱性相关的代码语句的强大选择过程。 200K+ C/C ++功能的实际数据集的实验结果表明，我们方法的优越性优于其他最先进的基线。通常，我们的方法在在无监督的设置中在现实世界数据集上运行时，在VCP，VCA和TOP-10 ACC测量中，基准的3％至14％的性能较高。我们已发布的源代码样本可在\ href {https://github.com/vannguyennd/livuitcl} {https://github.com/vannguyennd/livuitcl。} {
Software vulnerabilities are a serious and crucial concern. Typically, in a program or function consisting of hundreds or thousands of source code statements, there are only a few statements causing the corresponding vulnerabilities. Most current approaches to vulnerability labelling are done on a function or program level by experts with the assistance of machine learning tools. Extending this approach to the code statement level is much more costly and time-consuming and remains an open problem. In this paper, we propose a novel end-to-end deep learning-based approach to identify the vulnerability-relevant code statements of a specific function. Inspired by the specific structures observed in real-world vulnerable code, we first leverage mutual information for learning a set of latent variables representing the relevance of the source code statements to the corresponding function's vulnerability. We then propose novel clustered spatial contrastive learning in order to further improve the representation learning and the robust selection process of vulnerability-relevant code statements. Experimental results on real-world datasets of 200k+ C/C++ functions show the superiority of our method over other state-of-the-art baselines. In general, our method obtains a higher performance in VCP, VCA, and Top-10 ACC measures of between 3% to 14% over the baselines when running on real-world datasets in an unsupervised setting. Our released source code samples are publicly available at \href{https://github.com/vannguyennd/livuitcl}{https://github.com/vannguyennd/livuitcl.}
