Software vulnerabilities (SVs) have become a common, serious and crucial
concern due to the ubiquity of computer software. Many machine learning-based
approaches have been proposed to solve the software vulnerability detection
(SVD) problem. However, there are still two open and significant issues for SVD
in terms of i) learning automatic representations to improve the predictive
performance of SVD, and ii) tackling the scarcity of labeled vulnerabilities
datasets that conventionally need laborious labeling effort by experts. In this
paper, we propose a novel end-to-end approach to tackle these two crucial
issues. We first exploit the automatic representation learning with deep domain
adaptation for software vulnerability detection. We then propose a novel
cross-domain kernel classifier leveraging the max-margin principle to
significantly improve the transfer learning process of software vulnerabilities
from labeled projects into unlabeled ones. The experimental results on
real-world software datasets show the superiority of our proposed method over
state-of-the-art baselines. In short, our method obtains a higher performance
on F1-measure, the most important measure in SVD, from 1.83% to 6.25% compared
to the second highest method in the used datasets. Our released source code
samples are publicly available at this https URL

本文提出了一种基于深度领域自适应和跨域核分类器的端到端方法，解决软件漏洞检测中的自动表示和标记数据集不足等关键问题。实验结果表明，该方法在 F1-Measure 等指标上的性能显著优于现有方法。

领域自适应和最大间隔原则的跨项目软件漏洞检测

Cross Project Software Vulnerability Detection via Domain Adaptation and Max-Margin Principle

Current machine-learning based software vulnerability detection methods are
primarily conducted at the function-level. However, a key limitation of these
methods is that they do not indicate the specific lines of code contributing to
vulnerabilities. This limits the ability of developers to efficiently inspect
and interpret the predictions from a learnt model, which is crucial for
integrating machine-learning based tools into the software development
workflow. Graph-based models have shown promising performance in function-level
vulnerability detection, but their capability for statement-level vulnerability
detection has not been extensively explored. While interpreting function-level
predictions through explainable AI is one promising direction, we herein
consider the statement-level software vulnerability detection task from a fully
supervised learning perspective. We propose a novel deep learning framework,
LineVD, which formulates statement-level vulnerability detection as a node
classification task. LineVD leverages control and data dependencies between
statements using graph neural networks, and a transformer-based model to encode
the raw source code tokens. In particular, by addressing the conflicting
outputs between function-level and statement-level information, LineVD
significantly improve the prediction performance without vulnerability status
for function code. We have conducted extensive experiments against a
large-scale collection of real-world C/C++ vulnerabilities obtained from
multiple real-world projects, and demonstrate an increase of 105\% in F1-score
over the current state-of-the-art.

本研究提出了一种新的深度学习框架 LineVD，通过图神经网络和基于 Transformer 的模型识别程序的特定代码行，取得了 105％的 F1 得分提高，扩展了现有方法在软件漏洞检测方面的应用。