一句话：构建首个跨过程漏洞数据集，揭示函数级检测器在跨过程漏洞上效果显著下降。
软件漏洞检测中，深度学习方法常将整个函数作为输入，即函数级漏洞检测器。然而，这类方法在跨过程漏洞（待修复语句与触发语句位于不同函数）上的局限尚不清楚。本文构建了面向 C/C++ 开源软件的首个跨过程漏洞数据集 InterPVD，并提出工具 VulTrigger，用于跨函数识别漏洞触发语句。实验表明，VulTrigger 能有效识别漏洞触发语句与跨过程漏洞。研究发现：跨过程漏洞普遍存在，平均涉及 2.8 个跨过程层次；函数级漏洞检测器检测跨过程漏洞待修复函数的效果，明显低于检测过程内漏洞对应函数的效果。
Software vulnerabilities are a major cyber threat and it is important to detect them. One important approach to detecting vulnerabilities is to use deep learning while treating a program function as a whole, known as function-level vulnerability detectors. However, the limitation of this approach is not understood. In this paper, we investigate its limitation in detecting one class of vulnerabilities known as inter-procedural vulnerabilities, where the to-be-patched statements and the vulnerability-triggering statements belong to different functions. For this purpose, we create the first Inter-Procedural Vulnerability Dataset (InterPVD) based on C/C++ open-source software, and we propose a tool dubbed VulTrigger for identifying vulnerability-triggering statements across functions. Experimental results show that VulTrigger can effectively identify vulnerability-triggering statements and inter-procedural vulnerabilities. Our findings include: (i) inter-procedural vulnerabilities are prevalent with an average of 2.8 inter-procedural layers; and (ii) function-level vulnerability detectors are much less effective in detecting to-be-patched functions of inter-procedural vulnerabilities than detecting their counterparts of intra-procedural vulnerabilities.
@inproceedings{paperbot11252,
title = {On the Effectiveness of Function-Level Vulnerability Detectors for Inter-Procedural Vulnerabilities},
author = {Zhen Li and Ning Wang and Deqing Zou and Yating Li and Ruqian Zhang and Shouhuai Xu and Chao Zhang and Hai Jin},
booktitle = {ICSE},
year = {2024},
doi = {10.1145/3597503.3639218}
}