一句话：提出 VGX，用定制 Transformer 与漏洞注入编辑模式大规模生成高质量脆弱程序样本，以提升基于学习的漏洞分析。
基于学习的软件漏洞分析因缺乏大规模、高质量的有标注脆弱程序样本而受限，现有自动样本生成方法噪声较高。本文提出 VGX，面向大规模生成高质量漏洞数据集。给定正常程序，VGX 先识别可注入漏洞的代码上下文，所用定制 Transformer 引入基于值流的位置编码，并针对代码结构与上下文学习设计新预训练目标；然后，它利用从历史修复和人类真实漏洞知识中获得的漏洞注入编辑模式，在目标上下文中实施代码编辑以生成脆弱样本。摘要未报告量化结果，目标是提升下游基于学习的漏洞分析。
Accompanying the successes of learning-based defensive software vulnerability analyses is the lack of large and quality sets of labeled vulnerable program samples, which impedes further advancement of those defenses. Existing automated sample generation approaches have shown potentials yet still fall short of practical expectations due to the high noise in the generated samples. This paper proposes VGX, a new technique aimed for large-scale generation of high-quality vulnerability datasets. Given a normal program, VGX identifies the code contexts in which vulnerabilities can be injected, using a customized Transformer featured with a new value-flow-based position encoding and pre-trained against new objectives particularly for learning code structure and context. Then, VGX materializes vulnerability-injection code editing in the identified contexts using patterns of such edits obtained from both historical fixes and human knowledge about real-world vulnerabilities.
@inproceedings{paperbot11481,
title = {VGX: Large-Scale Sample Generation for Boosting Learning-Based Software Vulnerability Analyses},
author = {Yu Nong and Richard Fang and Guangbei Yi and Kunsong Zhao and Xiapu Luo and Feng Chen and Haipeng Cai},
booktitle = {ICSE},
year = {2024},
doi = {10.1145/3597503.3639116}
}