一句话：提出仅用正例与未标注数据的 PILOT 模型，通过伪标签与混合监督表示学习提升漏洞检测。
基于深度学习的漏洞检测通常依赖大量标注数据，但当前标签多自动收集，质量难以保证；已有研究表明常用的无漏洞代码（负标签）往往不可靠，而有漏洞代码（正标签）更确定。本文针对漏洞检测中的正例与未标注（PU）学习问题，提出 PILOT 模型，仅从正例和未标注数据中学习。PILOT 包含两个模块：距离感知标签选择模块利用类间距离原型和渐进微调为选定的未标注数据生成伪标签；混合监督表示学习模块进一步缓解噪声影响并增强表示判别力。在真实漏洞数据集上的大量实验表明，PILOT 在 PU 设定下比常用弱监督方法提升 2.78%-18.93%；在监督设定下，其 F1 分数也比当前最优方法提升 1.34%-12.46%。此外，人工检查显示 PILOT 能在 FFMPeg+Qemu 数据集上识别出 23 个误标样本。
Automated code vulnerability detection has gained increasing attention in recent years. The deep learning (DL)-based methods, which implicitly learn vulnerable code patterns, have proven effective in vulnerability detection. The performance of DL-based methods usually relies on the quantity and quality of labeled data. However, the current labeled data are generally automatically collected, such as crawled from human-generated commits, making it hard to ensure the quality of the labels. Prior studies have demonstrated that the non-vulnerable code (i.e., negative labels) tends to be unreliable in commonly-used datasets, while vulnerable code (i.e., positive labels) is more determined. Considering the large numbers of unlabeled data in practice, it is necessary and worth exploring to leverage the positive data and large numbers of unlabeled data for more accurate vulnerability detection. In this paper, we focus on the Positive and Unlabeled (PU) learning problem for vulnerability detection and propose a novel model named PILOT, i.e., Positive and unlabeled Learning mOdel for vulnerability deTection. PILOT only learns from positive and unlabeled data for vulnerability detection. It mainly contains two modules: (1) A distance-aware label selection module, aiming at generating pseudo-labels for selected unlabeled data, which involves the inter-class distance prototype and progressive fine-tuning; (2) A mixed-supervision representation learning module to further alleviate the influence of noise and enhance the discrimination of representations. Extensive experiments in vulnerability detection are conducted to evaluate the effectiveness of PILOT based on real-world vulnerability datasets. The experimental results show that PILOT outperforms the popular weakly supervised methods by 2.78%-18.93% in the PU learning setting. Compared with the state-of-the-art methods, PILOT also improves the performance of 1.34%-12.46 % in F1 score metrics in the supervised setting. In addition, PILOT can identify 23 mislabeled from the FFMPeg+Qemu dataset in the PU learning setting based on manual checking.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{abs-2308-10523,
title = {When Less is Enough: Positive and Unlabeled Learning Model for Vulnerability Detection},
author = {Xin-Cheng Wen and Xinchen Wang and Cuiyun Gao and Shaohua Wang and Yang Liu and Zhaoquan Gu},
booktitle = {ASE},
year = {2023},
doi = {10.1109/ase56229.2023.00144}
}