Detecting Vulnerabilities via Explicitly Leveraging Vulnerability Features on Program Slices

Abstract

As the size and complexity of software continue to increase, detecting software vulnerabilities becomes increasingly challenging. Traditional static and dynamic analysis methods often suffer from poor accuracy or little reliance on expert knowledge. In recent years, deep learning has emerged as a promising direction in this field due to its ability to automatically learn the subtle features in the massive software data. However, existing deep learning-based vulnerability detection methods have the following limitations: 1) They struggle with processing long source code sequences effectively, leading to sub-optimal feature representation. 2) Although they can find similar vulnerability features across different vulnerable programs, they often fail to explicitly leverage these vulnerability features, resulting in slightly inferior performance of model detection. In this paper, we propose a vulnerability detection method called DV-LVF, based on explicitly leveraging vulnerability features on program slices, to effectively detect vulnerabilities at both function and statement levels. Specifically, we introduce Gated Recurrent Unit (GRU) statement embedding technique combined with program slicing to enhance program feature representation. We introduce a vulnerability dictionary (vulDict), which can explicitly summarize and exploit these vulnerability features, to improve the performance of model detection. Our evaluation on real-world software shows that DV-LVF outperforms the state-of-the-art in both function-level and statement-level detection.