paperbot · PL 论文追踪

全部论文 待读 收藏

P2 Coca: Improving and Explaining Graph Neural Network-Based Vulnerability Detection Systems

Coca：改进与解释基于图神经网络的漏洞检测系统
ICSE Proceedings of the IEEE/ACM 46th International Conference on Software Engineering2024匹配度 3/10 · 论文研究GNN漏洞检测与可解释性，属于AI应用于软件安全，未涉及用户核心关注的静态分析、LLM/Agent改进分析、浮点或贝叶斯程序分析，与研究方向匹配度较低。引用 38 inbox
Sicong Cao, Xiaobing Sun, Xiaoxue Wu, David Lo, Lili Bo, Bin Li, Wei Liu
机器学习与程序语言安全与隐私
crossref: 2026-09-12

AI 速览

一句话：提出 Coca，在提升 GNN 漏洞检测效果的同时给出更可靠的解释，缓解伪相关与冗余问题。

近年来，基于图神经网络（GNN）的漏洞检测系统取得了显著成效，但黑盒模型缺乏可解释性，这成为其在安全相关领域落地部署的关键障碍。已有工作试图通过给出对预测结果有正向贡献的关键语句集合来解释检测模型的决策逻辑，然而由于检测模型本身鲁棒性较弱、解释策略也非最优，这类解释存在暴露伪相关（spurious correlation）与信息冗余的风险。本文提出 Coca，目标是在改进基于 GNN 的漏洞检测系统的同时，为其提供更可靠的解释，从而缓解上述伪相关与冗余问题。作者来自软件与安全相关研究团队，工作围绕 GNN 漏洞检测系统的可解释性这一核心挑战展开。

问题
GNN 漏洞检测系统性能虽好但属于黑盒，难以在安全场景中部署；已有解释方法因模型鲁棒性弱与解释策略次优，会给出含伪相关和冗余的解释。
方法
提出 Coca，用以改进并解释基于 GNN 的漏洞检测系统，针对伪相关与冗余问题设计更优的检测与解释方案（摘要未展开具体技术细节）。
评估
摘要未给出具体评估设置与结果，仅指出既有解释方法存在伪相关与冗余缺陷。
原文摘要（Abstract）

Recently, Graph Neural Network (GNN)-based vulnerability detection systems have achieved remarkable success. However, the lack of explainability poses a critical challenge to deploy black-box models in security-related domains. For this reason, several approaches have been proposed to explain the decision logic of the detection model by providing a set of crucial statements positively contributing to its predictions. Unfortunately, due to the weakly-robust detection models and suboptimal explanation strategy, they have the danger of revealing spurious correlations and redundancy issue.

链接与引用

DOI 原文 ·

BibTeX 
@inproceedings{paperbot11469,
  title = {Coca: Improving and Explaining Graph Neural Network-Based Vulnerability Detection Systems},
  author = {Sicong Cao and Xiaobing Sun and Xiaoxue Wu and David Lo and Lili Bo and Bin Li and Wei Liu},
  booktitle = {ICSE},
  year = {2024},
  doi = {10.1145/3597503.3639168}
}