PaperlayerView exact revision on arXiv

Source-linked AI summary

MVD: Memory-Related Vulnerability Detection Based on Flow-Sensitive Graph Neural Networks

Sicong Cao, Xiaobing Sun, Lili Bo, Rongxin Wu, Bin Li, Chuanqi Tao

arXiv:2203.02660v1cs.CRcs.SE

TL;DR

Memory-related vulnerability detection lacks sufficient flow-sensitive and fine-grained modeling, despite the security impact of these vulnerabilities. MVD uses FS-GNN to combine source-code, control-flow, and data-flow information for statement-level detection, and reports better accuracy than the compared deep-learning and static-analysis approaches.

  • Problem

    Existing vulnerability detectors underuse flow information and generally operate above statement level, limiting memory-related vulnerability detection.

  • Method

    MVD uses FS-GNN to jointly embed source code with control- and data-flow information for statement-level vulnerability detection.

  • Results

    MVD achieves better detection accuracy than three deep-learning and five static-analysis memory detectors on 4,353 real-world vulnerabilities.

  • Takeaways & Limitations

    MVD effectively identifies memory-related vulnerability statements while making a trade-off between detection accuracy and efficiency.

  • Takeaways & Limitations

    The evaluation is limited to memory-related vulnerabilities in C/C++ programs, and results may not generalize to more complex vulnerabilities or languages.

Abstract

from arXiv · show

Memory-related vulnerabilities constitute severe threats to the security of modern software. Despite the success of deep learning-based approaches to generic vulnerability detection, they are still limited by the underutilization of flow information when applied for detecting memory-related vulnerabilities, leading to high false positives. In this paper,we propose MVD, a statement-level Memory-related Vulnerability Detection approach based on flow-sensitive graph neural networks (FS-GNN). FS-GNN is employed to jointly embed both unstructured information (i.e., source code) and structured information (i.e., control- and data-flow) to capture implicit memory-related vulnerability patterns. We evaluate MVD on the dataset which contains 4,353 real-world memory-related vulnerabilities, and compare our approach with three state-of-the-art deep learning-based approaches as well as five popular static analysisbased memory detectors. The experiment results show that MVD achieves better detection accuracy, outperforming both state-of-theart DL-based and static analysis-based approaches. Furthermore, MVD makes a great trade-off between accuracy and efficiency.

1 INTRODUCTION

MVD addresses limitations in memory-related vulnerability detection by combining flow-sensitive graph learning with statement-level classification. It is evaluated on a newly constructed dataset of 4,353 real-world vulnerabilities and outperforms the compared deep-learning and static-analysis approaches.

  • 1 INTRODUCTION: Existing static analyzers depend on expert-defined rules, making comprehensive coverage difficult for sophisticated real-world programming logic.
  • 1 INTRODUCTION: Deep-learning detectors underuse flow information through limited interprocedural analysis and loss of multiple flow relations during training.These limitations can produce incomplete semantic modeling and lower Recall and Precision.
  • 1 INTRODUCTION: Existing deep-learning approaches commonly detect vulnerabilities at function or slice level, leaving developers to manually narrow suspicious statements.MVD instead targets fine-grained statement identification.
  • 1 INTRODUCTION: MVD combines source-code representations with control- and data-flow information in a flow-sensitive graph neural network for memory-related vulnerability detection.Its contributions include FS-GNN and formalizing detection as node classification.
  • 1 INTRODUCTION: MVD is evaluated on 4,353 real-world memory-related vulnerabilities because no existing dataset directly supports statement-level model training.The dataset and empirical data are made available online.
  • 1 INTRODUCTION: MVD effectively detects memory-related vulnerabilities against three deep-learning and five static-analysis approaches.

2 BASICS AND MOTIVATION

The motivating example shows why memory-vulnerability detection requires interprocedural, flow-sensitive reasoning. MVD enriches program graphs with call and return information and propagates contextual semantics to classify vulnerable statements.

  • 2.2 Motivating Examples: A use-after-free vulnerability releases req before later uses, whereas the patched version releases it only after its final use.The premature release may allow attackers to write malicious data.
  • 2.2 Motivating Examples: Interprocedural analysis is necessary because user-defined allocation or deallocation functions can be missed by detectors lacking call-relation information.The example notes that some static analyzers may not recognize mempool_free() as a user-defined deallocation function.
  • 2.2 Motivating Examples: MVD extends a Program Dependence Graph with call relations and return values from a Call Graph to capture precise interprocedural semantics.PDG edges represent data and control dependencies, while the Call Graph represents caller-to-callee calls.
  • 2.2 Motivating Examples: One-directional multi-relation propagation can lose output-flow context, such as data-flow information needed to update a vulnerable statement.The example identifies FUNDED as an approach with this limitation.
  • 2.2 Motivating Examples: FS-GNN jointly embeds statements and flow information, aggregating neighbor context through multiple relations to update a central statement representation.

3 OUR APPROACH: MVD

MVD extracts interprocedural flow-sensitive program representations and applies FS-GNN to classify vulnerable statements at node level. It combines statement embeddings, typed flow relations, graph resampling, and classification to model memory-related vulnerability patterns.

  • 3.1 Feature Extraction: MVD uses interprocedural PDG construction, CG-derived call and return information, and targeted slicing to retain memory-relevant program semantics.Slicing starts from system API calls or pointer variables, using backward control- and data-dependence and forward data-dependence.
  • 3.3 Graph Learning: The resulting graph model classifies statement nodes as vulnerable or non-vulnerable using both unstructured statement features and structured flow features.This formulation targets suspicious statements rather than only functions or slices.
  • 3.1 Feature Extraction: The feature-extraction example adds call and return edges, then removes nodes unrelated to the selected sensitive function call through slicing.In the memory-leak example, Node 6 is removed because it is not data-dependent on the selected vulnerable Node 5.
  • 3.2 Node Embedding: MVD represents each statement as a fixed-length Doc2Vec vector that preserves code-statement semantic information for graph learning.These statement vectors are transformed into low-dimensional node features before entering the graph neural network.
  • 3.3 Graph Learning: FS-GNN jointly embeds statement nodes and multiple typed flow edges, updating node representations through relation-aware composition and edge-specific parameters.It adds inverse edges with distinct weights so contextual information from outgoing flows receives different treatment.
  • 3.3 Graph Learning: MVD oversamples vulnerable nodes with GraphSMOTE because vulnerable and non-vulnerable statement nodes remain highly imbalanced after slicing.Synthetic vulnerable nodes are connected to vulnerable and non-vulnerable nodes to rebalance the training distribution.

4 EXPERIMENTS

The experiments evaluate MVD against deep learning and static-analysis detectors using a newly constructed C/C++ memory-vulnerability dataset. They also assess statement-level detection, flow-sensitive modeling, and efficiency.

  • 4.2.1 Dataset: The dataset contains 4,353 memory-related vulnerabilities drawn from SARD and CVE, covering 13 common vulnerability types in C/C++ programs.It includes 1,208 real-world CVE vulnerabilities from 10 open-source projects and 3,145 vulnerable SARD samples.
  • 4.2.1 Dataset: CWE-119 accounts for the largest dataset share, representing 40% and 1,731 vulnerable samples.
  • 4.2.2 Baselines: MVD is compared with VulDeePecker, SySeVR, and Devign for deep-learning evaluation, and with PCA, Saber, Flawfinder, RATS, and Infer for static-analysis evaluation.The selected baselines are established approaches for vulnerability detection and memory-related vulnerability analysis.
  • 4.2.3 Evaluation Setup: For statement-level evaluation, the study samples 30 recent real-world vulnerabilities spanning memory leaks, double frees, buffer overflows, use-after-free, and out-of-bounds reads or writes.These samples are excluded from training to test detection on unseen programs.
  • 4.3 Evaluation Metrics: The evaluation uses Accuracy, Recall, and F1 score to measure detection effectiveness, while additional experiments replace FS-GNN with GCN, GGNN, and RGCN and record training and detection time.These experiments examine the contribution of FS-GNN and the accuracy-efficiency trade-off.

5 EXPERIMENTAL RESULTS

MVD outperforms the evaluated deep learning and static analysis baselines for memory-related vulnerability detection, while preserving a favorable accuracy–efficiency trade-off. Its flow-sensitive graph design improves results by retaining interprocedural control- and data-flow information.

  • RQ1: MVD vs. DL-Based Approaches: MVD averages 74.1% Accuracy, 61.5% Precision, 69.4% Recall, and 65.2% F1, improving Devign by 5.0%-12.2% across metrics.MVD outperformed all three compared deep learning approaches.
  • RQ2: MVD vs. Static Analysis-Based Approaches: MVD outperforms static analysis baselines, improving PCA by 4.1% Recall and 12.1% Precision.PCA had the strongest static-analysis results, with 48.9% Precision and 61.1% Recall.
  • RQ2: MVD vs. Static Analysis-Based Approaches: 17 of 30 real-world vulnerabilities were detected by MVD, including nine missed by all baselines and eight more than PCA.The evaluated vulnerabilities covered five common memory-related vulnerability types.
  • RQ3: FS-GNN vs. Other GNNs: FS-GNN improves the best-performing RGCN baseline by 6.7%-14.4% by incorporating edge types and inverse edges into representation learning.These design choices preserve interprocedural control- and data-flow semantics for node updates and information propagation.
  • RQ4: Efficiency: MVD achieves relatively shorter detection time than other approaches except PCA while requiring substantial training time.Its stronger detection results and shorter detection time produce a trade-off between accuracy and efficiency.

6 THREATS TO VALIDITY

The study’s validity is constrained by dataset generalizability, manual node labeling, and reimplemented baseline comparisons. Results may not transfer reliably beyond the evaluated C/C++ memory-vulnerability setting.

  • External validity: Results may not generalize reliably because the evaluation covers 4,353 vulnerable samples from 10 C/C++ open-source projects and SARD, while practical code can be much more complex.The study is limited to memory-related vulnerabilities in C/C++ programs.
  • Internal validity: Manual labeling of nodes without delete statements may introduce mislabeled samples despite review by three experienced researchers.The authors attempted to reduce harmful effects from incorrect labels through multi-researcher labeling.
  • Internal validity: Reimplementing the closed-source Devign baseline and tuning its parameters on the dataset may affect comparisons with existing deep-learning approaches.The implementation of baselines is identified as a separate threat to experiment validity.

7 RELATED WORKS

Related work spans static, dynamic, and learning-based memory-vulnerability detection. Existing learning-based methods increasingly model code semantics with slices or graphs, while static methods rely on vulnerability patterns and dynamic methods monitor runtime memory behavior.

  • Overview: Memory-related vulnerability detection approaches are grouped into static analysis-based, dynamic analysis-based, and learning-based categories.This taxonomy organizes the reviewed prior work.
  • Prior approaches: Static methods search for specific vulnerability patterns or model memory state, dynamic methods track allocation and release during execution, and learning methods infer vulnerability features from known examples.Representative static systems include FastCheck, Saber, and Pinpoint; LEAKPOINT and DoubleTake exemplify dynamic analysis.
  • Learning-based approaches: Learning-based approaches use syntax, semantic, textual, and structured code representations with slice-based models, GCNs, and GNNs to detect vulnerabilities.Examples include VulDeePecker, SySeVR, FUNDED, and graph-based models combining multiple code relationships.

8 CONCLUSION

MVD detects memory-related vulnerability statements using a flow-sensitive graph neural network that jointly represents code and program structure. The authors report effectiveness against deep-learning and static-analysis baselines, while identifying broader evaluation as future work.

  • Conclusion: MVD uses FS-GNN to jointly embed unstructured source code and structured information, preserving high-level program semantics for implicit vulnerability-pattern learning.The approach targets memory-related vulnerability statements associated with sensitive operations.
  • Conclusion: MVD’s effectiveness is evaluated against three state-of-the-art deep-learning techniques and five popular static-analysis memory detectors.The supplied conclusion reports the comparison scope but not individual metric values.
  • Conclusion: Future work will expand comparisons to more detectors and larger datasets and investigate code representations that model memory-specific flow information efficiently.DeepWukong is given as an example of an additional deep-learning approach.
Loading 2203.02660v1…