Deep learning vulnerability detection tools are increasing in popularity and
have been shown to be effective. These tools rely on large volume of high
quality training data, which are very hard to get. Most of the currently
available datasets provide function-level labels, reporting whether a function
is vulnerable or not vulnerable. However, for a vulnerability detection to be
useful, we need to also know the lines that are relevant to the vulnerability.
This paper makes efforts towards developing systematic tools and proposes.
ActiveClean to generate the large volume of line-level vulnerability data from
commits. That is, in addition to function-level labels, it also reports which
lines in the function are likely responsible for vulnerability detection. In
the past, static analysis has been applied to clean commits to generate
line-level data. Our approach based on active learning, which is easy to use
and scalable, provide a complementary approach to static analysis. We designed
semantic and syntactic properties from commit lines and use them to train the
model. We evaluated our approach on both Java and C datasets processing more
than 4.3K commits and 119K commit lines. AcitveClean achieved an F1 score
between 70-74. Further, we also show that active learning is effective by using
just 400 training data to reach F1 score of 70.23. Using ActiveClean, we
generate the line-level labels for the entire FFMpeg project in the Devign
dataset, including 5K functions, and also detected incorrect function-level
labels. We demonstrated that using our cleaned data, LineVul, a SOTA line-level
vulnerability detection tool, detected 70 more vulnerable lines and 18 more
vulnerable functions, and improved Top 10 accuracy from 66% to 73%.

通过使用 ActiveClean 生成大规模的行级漏洞数据，并提出基于主动学习的方法，该方法利用语义和句法属性进行模型训练，同时通过清理数据提高了 LineVul 的准确性和性能。

ActiveClean: 通过主动学习生成基于行级漏洞数据

ActiveClean: Generating Line-Level Vulnerability Data via Active  Learning

Deep learning vulnerability detection has shown promising results in recent
years. However, an important challenge that still blocks it from being very
useful in practice is that the model is not robust under perturbation and it
cannot generalize well over the out-of-distribution (OOD) data, e.g., applying
a trained model to unseen projects in real world. We hypothesize that this is
because the model learned non-robust features, e.g., variable names, that have
spurious correlations with labels. When the perturbed and OOD datasets no
longer have the same spurious features, the model prediction fails. To address
the challenge, in this paper, we introduced causality into deep learning
vulnerability detection. Our approach CausalVul consists of two phases. First,
we designed novel perturbations to discover spurious features that the model
may use to make predictions. Second, we applied the causal learning algorithms,
specifically, do-calculus, on top of existing deep learning models to
systematically remove the use of spurious features and thus promote causal
based prediction. Our results show that CausalVul consistently improved the
model accuracy, robustness and OOD performance for all the state-of-the-art
models and datasets we experimented. To the best of our knowledge, this is the
first work that introduces do calculus based causal learning to software
engineering models and shows it's indeed useful for improving the model
accuracy, robustness and generalization. Our replication package is located at
this https URL

该研究论文介绍了引入因果关系到深度学习漏洞检测中，通过设计新的扰动和应用因果学习算法来去除非稳健特征，从而提高模型的准确性、稳健性和泛化能力。