$\mu$VulDeePecker: A Deep Learning-Based System for Multiclass Vulnerability Detection

Abstract

Fine-grained software vulnerability detection is an important and challenging problem. Ideally, a detection system (or detector) not only should be able to detect whether or not a program contains vulnerabilities, but also should be able to pinpoint the type of a vulnerability in question. Existing vulnerability detection methods based on deep learning can detect the presence of vulnerabilities (i.e., addressing the binary classification or detection problem), but cannot pinpoint types of vulnerabilities (i.e., incapable of addressing multiclass classification). In this paper, we propose the first deep learning-based system for multiclass vulnerability detection, dubbed $\mu$VulDeePecker. The key insight underlying $\mu$VulDeePecker is the concept of code attention, which can capture information that can help pinpoint types of vulnerabilities, even when the samples are small. For this purpose, we create a dataset from scratch and use it to evaluate the effectiveness of $\mu$VulDeePecker. Experimental results show that $\mu$VulDeePecker is effective for multiclass vulnerability detection and that accommodating control-dependence (other than data-dependence) can lead to higher detection capabilities.

To be published in IEEE Transactions on Dependable and Secure Computing

References in corpus (5)

• Efficient Estimation of Word Representations in Vector Space
• Distributed Representations of Words and Phrases and their Compositionality
• VulDeePecker: A Deep Learning-Based System for Vulnerability Detection
• SourcererCC: Scaling Code Clone Detection to Big Code
• A deep tree-based model for software defect prediction

Cited by in corpus (11)

• SySeVR: A Framework for Using Deep Learning to Detect Software Vulnerabilities
• CVEfixes: Automated Collection of Vulnerabilities and Their Fixes from Open-Source Software
• VulDeeLocator: A Deep Learning-based Fine-grained Vulnerability Detector
• MVD: Memory-Related Vulnerability Detection Based on Flow-Sensitive Graph Neural Networks
• A Survey on Data-driven Software Vulnerability Assessment and Prioritization
• A Survey of Source Code Representations for Machine Learning-Based Cybersecurity Tasks
• WeakSATD: Detecting Weak Self-admitted Technical Debt
• A Hybrid Graph Neural Network Approach for Detecting PHP Vulnerabilities
• Literature review on vulnerability detection using NLP technology
• Towards Making Deep Learning-based Vulnerability Detectors Robust
• LLaVul: A Multimodal LLM for Interpretable Vulnerability Reasoning about Source Code