PaperlayerView exact revision on arXiv

Source-linked AI summary

Vulnerability Detection with Fine-grained Interpretations

Yi Li, Shaohua Wang, Tien N. Nguyen

arXiv:2106.10478v1cs.CRcs.SE

TL;DR

ML/DL vulnerability detectors often provide only method-level decisions, leaving relevant vulnerable statements unspecified. IVDetect separates vulnerable statements from their dependency-based contexts for detection and uses interpretable ML to extract relevant PDG sub-graphs. It outperformed existing DL-based approaches on reported ranking metrics and identified relevant vulnerable statements in 67% of cases with a top-5 list.

  • Problem

    ML/DL vulnerability detectors generally report whether an entire method is vulnerable without identifying the relevant statements, limiting fine-grained investigation.

  • Method

    IVDetect uses context-aware PDG representation learning with feature-attention GCN detection and GNNExplainer-based extraction of relevant vulnerability sub-graphs.

  • Results

    IVDetect outperformed existing DL-based approaches by 64%–122% in top-10 nDCG and 105%–255% in MAP, and identified relevant vulnerable statements in 67% of cases with a top-5 list.

  • Takeaways & Limitations

    IVDetect provides ranked vulnerable methods together with fine-grained interpretations consisting of relevant statements and program dependencies.

  • Takeaways & Limitations

    The authors identify unseen vulnerabilities and dependency-related false or missed vulnerable statements as key limitations.

Abstract

from arXiv · show

Despite the successes of machine learning (ML) and deep learning (DL) based vulnerability detectors (VD), they are limited to providing only the decision on whether a given code is vulnerable or not, without details on what part of the code is relevant to the detected vulnerability. We present IVDetect an interpretable vulnerability detector with the philosophy of using Artificial Intelligence (AI) to detect vulnerabilities, while using Intelligence Assistant (IA) via providing VD interpretations in terms of vulnerable statements. For vulnerability detection, we separately consider the vulnerable statements and their surrounding contexts via data and control dependencies. This allows our model better discriminate vulnerable statements than using the mixture of vulnerable code and~contextual code as in existing approaches. In addition to the coarse-grained vulnerability detection result, we leverage interpretable AI to provide users with fine-grained interpretations that include the sub-graph in the Program Dependency Graph (PDG) with the crucial statements that are relevant to the detected vulnerability. Our empirical evaluation on vulnerability databases shows that IVDetect outperforms the existing DL-based approaches by 43%--84% and 105%--255% in top-10 nDCG and MAP ranking scores. IVDetect correctly points out the vulnerable statements relevant to the vulnerability via its interpretation~in 67% of the cases with a top-5 ranked list. It improves over baseline interpretation models by 12.3%--400% and 9%--400% in accuracy.

1 INTRODUCTION

IVDetect addresses the coarse-grained outputs of ML/DL vulnerability detectors by combining context-aware detection with fine-grained interpretations of vulnerable statements and dependencies.

  • Problem: Existing ML/DL vulnerability detectors usually identify whether an entire method is vulnerable without locating relevant statements.This limits developers’ ability to investigate and fix detected vulnerabilities.
  • Detection: IVDetect separates vulnerable statements from surrounding code connected by data and control dependencies during representation learning.The model represents source code as a PDG and performs graph classification with a feature-attention GCN.
  • Interpretation: IVDetect uses interpretable ML to produce a PDG sub-graph containing crucial statements and dependencies relevant to a detected vulnerability.GNNExplainer searches for a minimal sub-graph whose prediction scores remain close to those from the full PDG.
  • Use: Practitioners can rank potentially vulnerable methods and then inspect the interpretation to investigate statements associated with the prediction.The interpretation is intended to provide more actionable detail than a method-level vulnerability score alone.
  • Evaluation: 43%–84% and 105%–255% improvements were reported over existing ML/DL approaches in top-10 nDCG and MAP, respectively.IVDetect also identified relevant vulnerable statements in 67% of cases with a top-5 ranked list and improved interpretation accuracy over ATT and GRAD.

2 MOTIVATION

The motivating example illustrates why vulnerability detection must connect vulnerable statements with their surrounding data and control-flow context. IVDetect uses PDG-based detection and interpretation modules to rank methods and identify crucial sub-graphs.

  • 2.1 Motivating Example: CVE-2016-6156 concerns a vulnerable Linux 4.6 method that constructs I/O control commands for ChromeOS devices.The example is listed in the National Vulnerability Database.
  • 2.1 Motivating Example: The motivating vulnerability involves inconsistent values from repeated user-space fetches, potentially causing a double-fetch bug and buffer overflow.The fix adds checks between fetches and adjusts the copied size to avoid excessive user-data transfer.
  • 2.1 Motivating Example: Existing DL-based approaches do not fully exploit vulnerable statements and their dependency-related contextual information during training.This can weaken discrimination between vulnerable and benign code.
  • 2.2 Key Ideas and Architecture Overview: IVDetect models methods as PDGs whose nodes represent statements and whose edges represent program dependencies, then applies graph-based vulnerability detection.The detection model learns from PDG structure and associated node features.
  • 2.2 Key Ideas and Architecture Overview: During training, IVDetect distinguishes each vulnerable statement from contextual statements with data or control dependencies.This representation is designed to help recognize vulnerable code in specific surrounding contexts.
  • 2.2 Key Ideas and Architecture Overview: After prediction, GNNExplainer identifies a minimal PDG sub-graph whose crucial statements and dependencies preserve the model’s decision.IVDetect consists of graph-based detection and interpretation modules.

3 GRAPH-BASED VULNERABILITY DETECTION MODEL

The model learns statement representations from lexical, structural, variable/type, and dependency-context features, then applies FA-GCN over the PDG for vulnerability detection.

  • 3.1 Representation Learning: Statement representations combine sub-token sequences, AST structure, variable names and types, and surrounding data- and control-dependent statements.Sub-token sequences use GloVe and GRU, while AST structure is encoded with Tree-LSTM; dependency contexts are also encoded with GloVe and GRU.
  • 3.1 Representation Learning: Data- and control-dependency contexts capture statements related to the current statement through those dependencies.For S27, the examples include data-dependent statements at lines 31, 22, 13, 10, and 6, and control-dependent statements at lines 29, 25, 23, and 13.
  • 3.1 Representation Learning: An attention-based bidirectional GRU learns feature weights before dependent PDG statements are combined into each statement’s final feature vector.The model weights feature vectors using W_i and then summarizes neighboring statements, such as S6, S22, S25, and S29 for S27.
  • 3.2 Vulnerability Detection with FA-GCN: FA-GCN parses each method into a PDG and applies graph convolution over sliding local windows containing a statement and its neighboring nodes.The window for S27 includes S27 and neighboring statements S6, S22, S25, and S29; FA-GCN is designed for sparse and potentially noisy PDG features.
  • 3.2 Vulnerability Detection with FA-GCN: Spatial pyramid pooling normalizes and reduces the method representation matrix before a fully connected layer transforms it into a vector.This follows the graph convolution stage and adapts the representation to a uniform size.

4 GRAPH-BASED INTERPRETATION MODEL

The interpretation model uses GNNExplainer and edge masking to identify a minimal PDG subgraph that preserves the FA-GCN prediction.

  • 4.1 Interpretation with GNNExplainer: After prediction, GNNExplainer receives the trained FA-GCN model, the method’s PDG, and the vulnerability decision and score.The same process is used for vulnerable and non-vulnerable outcomes.
  • 4.1 Interpretation with GNNExplainer: The interpretation subgraph minimizes the difference between prediction scores from the full PDG and the selected minimal subgraph.This subgraph is intended to capture statements and dependencies relevant to the detected vulnerability.
  • 4.1 Interpretation with GNNExplainer: Edge masking retains edges whose removal changes the FA-GCN result and excludes edges whose removal leaves the result unchanged.The retained edges form the interpretation subgraph.
  • 4.2 Mutual-Information Objective: GNNExplainer formulates subgraph selection by maximizing mutual information between the interpretation subgraph and the model outcome.Because the model’s entropy term is constant, this is equivalent to minimizing conditional entropy.
  • 4.2 Mutual-Information Objective: The interpretation subgraph is constrained to K_M edges with the highest mutual information and is learned through an edge mask because direct optimization is intractable.The resulting masked subgraph is directly used as the interpretation.

5 EMPIRICAL EVALUATION

The evaluation compares IVDetect with deep-learning vulnerability detectors and interpretation models across multiple datasets and ranking-based metrics. It also describes procedures for testing interpretation accuracy, mining vulnerability and fixing patterns, and analyzing feature sensitivity.

  • Experimental Design: The study evaluates method-level vulnerability detection against state-of-the-art deep-learning approaches and fine-grained interpretation against alternative interpretation models.The experiments use three vulnerability datasets and separate detection from statement-level interpretation evaluation.
  • Evaluation Metrics: The method-level evaluation ranks methods by vulnerability scores and uses metrics including nDCG, MAP, precision, recall, F score, first ranking, average ranking, and AUC.The study also compares IVDetect with baselines including VulDeePecker, Devign, SySeVR, ATT, and GRAD.
  • Experimental Design: Interpretation evaluation uses the Fan dataset because it contains vulnerable statements and corresponding fixes, unlike the other two datasets.The evaluation set contains vulnerable methods correctly detected as vulnerable; incorrect detections are treated as incorrect interpretations.
  • Interpretation Evaluation: Interpretations are judged correct when the generated subgraph overlaps statements changed to fix a vulnerability or contains dependency-linked statements corresponding to added fixes.The procedure also reports Mean First Ranking and Mean Average Ranking for relevant statements selected by the interpretation model.
  • Additional Analyses: The experiments additionally mine vulnerable-code and fixing patterns from interpretation subgraphs and perform sensitivity analysis for features and cross-dataset evaluation.Cross-data evaluation trains on Reveal and FFMPeg+Qemu and tests on Fan after tuning on part of Fan.

6 EXPERIMENTAL RESULTS

IVDetect consistently improves method-level vulnerability ranking and fine-grained statement interpretation across evaluated datasets, while its PDG-based features and GNNExplainer contribute to these results.

  • Method-Level VD: 43%–84% nDCG@10 and 105%–255% MAP@10 improvements are reported over existing baselines.At top 20, the reported improvements are 37%–71% for nDCG and 53%–116% for MAP.
  • Method-Level VD: IVDetect ranks vulnerable methods earlier, with first rank 1 versus 4 for the next-best performer and 2.7–4.0 higher average positions at AR@10.It also reports relatively higher AUC by 6%–24%.
  • Method-Level VD: IVDetect consistently achieves better MAP and nDCG scores than baselines across top-1 to top-100 ranked lists.The reported comparisons cover three vulnerability datasets and multiple ranking cutoffs.
  • Cross-Dataset Validation: Cross-dataset MAP and nDCG are lower than within-dataset results, while cross-dataset FR and AR are one rank higher.The paper attributes the within-dataset advantage to possible exposure to similar vulnerable code from the same projects.
  • Method-Level VD: On the Fan dataset, IVDetect detects 15, 10, 9, 6, and 5 more vulnerable methods than VulDeePecker, SySeVR, Russell, Devign, and Reveal, respectively.These comparisons use overlapping top-100 results.
  • Fine-Grained Interpretation: GNNExplainer improves interpretation accuracy over ATT and GRAD by 12.3%–400% and 9.0%–400%, respectively, across sub-graphs of 1–10 statements.It also improves MFR by 0.7 and 1.3 ranks and MAR by 0.6 and 1.3 ranks over ATT and GRAD.
  • Fine-Grained Interpretation: GNNExplainer directly scores masked subgraphs, whereas ATT weights edges and GRAD computes loss gradients with respect to adjacency-matrix inputs.The paper notes that edge averaging across multiple paths may reduce ATT precision and that gradients may perform poorly for discrete inputs.
  • Sensitivity Analysis: Adding internal features generally improves nDCG, MAP, AUC, FR, and AR; sub-token, AST, and additional representations improve top-20 ranking metrics incrementally.With token sequences alone, the first correct detection is at position 14 and nDCG@{1,5,10} and MAP@{1,5,10} are zero.

7 RELATED WORK

Prior vulnerability detectors include rule-based static analysis, feature-based machine learning, and deep learning approaches using varied code representations. Existing deep learning detectors are described as lacking model interpretations.

  • Rule-Based and Static Analysis: Rule-based and static-analysis vulnerability detectors use manually defined patterns, often targeting specific vulnerability types.Examples include FlawFinder, RATS, ITS4, Checkmarx, Fortify, and Coverity.
  • Machine Learning: Machine learning vulnerability detectors commonly use human-crafted or summarized metrics to predict whether code is vulnerable.Reported features include terms, imports, function calls, complexity, code churn, developer activity, dependencies, API symbols, and subtrees.
  • Deep Learning: Deep learning vulnerability detectors use lexical, API-related, syntax-based, semantic, vector, or graph-based code representations.The cited approaches include models trained on synthetic functions, API-call snippets, syntax and semantics, and graphs.
  • Deep Learning: The reviewed deep learning approaches are not designed to provide interpretations for their vulnerability predictions.This limitation motivates interpretable vulnerability detection in the paper.

8 CONCLUSION

IVDetect provides PDG sub-graphs explaining graph-based vulnerability predictions and outperforms existing DL-based approaches on vulnerability-database evaluations. Its limitations include unseen vulnerabilities and dependency-related false positives or missed statements, while comparisons with static-analysis tools remain future work.

  • 64%–122% and 105%–255% gains over existing DL-based approaches were reported in top-10 nDCG and MAP ranking scores.The evaluation used vulnerability databases.
  • IVDetect’s key limitations include unseen vulnerabilities and incorrectly identified or missed vulnerable statements caused by data/control dependencies.Multiple dependency edges can also contribute to missed vulnerable statements.
  • The study compares IVDetect with ML/DL-based detection approaches rather than static-analysis tools, leaving direct comparison with static analysis for future work.The authors state that future work will compare IVDetect with static-analysis tools.
Loading 2106.10478v1…