一句话：提出 AMPLE 框架，通过图简化缩短节点距离并增强图表示学习，提升深度学习漏洞检测对全局信息的捕获能力。
现有的基于深度学习的漏洞检测方法多采用图神经网络（GNN）学习源代码的结构图表示，但 GNN 本身难以处理代码结构图中长距离节点之间的连接，且未能充分利用图中多种类型的边（如数据流边与控制流边），因而难以捕获代码图的全局信息（节点间的长程依赖）。为此，本文提出漏洞检测框架 AMPLE，包含两个主要部分：（1）图简化，通过收缩代码结构图的节点规模来缩短节点之间的距离；（2）增强图表示学习，其中边感知图卷积网络模块将异构的边信息融合进节点表示，核缩放表示模块则用于刻画远距离图节点之间的关系。作者在三个公开基准数据集上进行实验，在准确率与 F1 指标上分别比当前最优方法高出 0.39%–35.32% 和 7.64%–199.81%，表明 AMPLE 能有效学习代码图的全局信息以用于漏洞检测。
Prior studies have demonstrated the effectiveness of Deep Learning (DL) in automated software vulnerability detection. Graph Neural Networks (GNNs) have proven effective in learning the graph representations of source code and are commonly adopted by existing DL-based vulnerability detection methods. However, the existing methods are still limited by the fact that GNNs are essentially difficult to handle the connections between long-distance nodes in a code structure graph. Besides, they do not well exploit the multiple types of edges in a code structure graph (such as edges representing data flow and control flow). Consequently, despite achieving state-of-the-art performance, the existing GNN-based methods tend to fail to capture global information (i.e., long-range dependencies among nodes) of code graphs. To mitigate these issues, in this paper, we propose a novel vulnerability detection framework with grAph siMplification and enhanced graph rePresentation LEarning, named AMPLE. AMPLE mainly contains two parts: 1) graph simplification, which aims at reducing the distances between nodes by shrinking the node sizes of code structure graphs; 2) enhanced graph representation learning, which involves one edge-aware graph convolutional network module for fusing heterogeneous edge information into node representations and one kernel-scaled representation module for well capturing the relations between distant graph nodes. Experiments on three public benchmark datasets show that AMPLE outperforms the state-of-the-art methods by 0.39%-35.32% and 7.64%-199.81% with respect to the accuracy and F1 score metrics, respectively. The results demonstrate the effectiveness of AMPLE in learning global information of code graphs for vulnerability detection.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{abs-2302-04675,
title = {Vulnerability Detection with Graph Simplification and Enhanced Graph Representation Learning},
author = {Xin-Cheng Wen and Yupan Chen and Cuiyun Gao and Hongyu Zhang and Jie M. Zhang and Qing Liao},
booktitle = {ICSE},
year = {2023},
doi = {10.1109/icse48619.2023.00191}
}