一句话：提出 SCALE，用 LLM 注释与 AST 构建结构化注释树，增强预训练模型的软件漏洞检测。
现有基于预训练模型的漏洞检测多以代码序列为输入，忽略漏洞相关结构信息，难以推断含多操作符、指针等复杂逻辑语句的语义，也难以理解多种代码执行序列。为此，论文提出 SCALE，在抽象语法树（AST）上构建结构化自然语言注释树（SCT）。该方法先用大语言模型生成注释并加入 AST 得到注释树，再结合代码语法模板显式编码执行序列，最后用 SCT 增强表示以捕捉漏洞模式。在 FFMPeg+Qemu、Reveal、SVulD 数据集上，SCALE 的 F1 较最佳基线分别提升 2.96%、13.47%、3.75%；用于 CodeBERT、UniXcoder 等预训练模型时，F1 提升 1.37% 至 10.87%。
Recently, there has been a growing interest in automatic software vulnerability detection. Pre-trained model-based approaches have demonstrated superior performance than other Deep Learning (DL)-based approaches in detecting vulnerabilities. However, the existing pre-trained model-based approaches generally employ code sequences as input during prediction, and may ignore vulnerability-related structural information, as reflected in the following two aspects. First, they tend to fail to infer the semantics of the code statements with complex logic such as those containing multiple operators and pointers. Second, they are hard to comprehend various code execution sequences, which is essential for precise vulnerability detection. To mitigate the challenges, we propose a Structured Natural Language Comment tree-based vulnerAbiLity dEtection framework based on the pre-trained models, named . The proposed Structured Natural Language Comment Tree (SCT) integrates the semantics of code statements with code execution sequences based on the Abstract Syntax Trees (ASTs).Specifically, comprises three main modules: (1) Comment Tree Construction, which aims at enhancing the model’s ability to infer the semantics of code statements by first incorporating Large Language Models (LLMs) for comment generation and then adding the comment node to ASTs. (2) Structured Natural Language Comment Tree Construction, which aims at explicitly involving code execution sequence by combining the code syntax templates with the comment tree. (3) SCT-Enhanced Representation, which finally incorporates the constructed SCTs for well capturing vulnerability patterns. Experimental results demonstrate that outperforms the best-performing baseline, including the pre-trained model and LLMs, with improvements of 2.96%, 13.47%, and 3.75% in terms of F1 score on the FFMPeg+Qemu, Reveal, and SVulD datasets, respectively. Furthermore, can be applied to different pre-trained models, such as CodeBERT and UniXcoder, yielding the F1 score performance enhancements ranging from 1.37% to 10.87%.
DOI 原文 ·
@inproceedings{paperbot8547,
title = {SCALE: Constructing Structured Natural Language Comment Trees for Software Vulnerability Detection},
author = {Xin-Cheng Wen and Cuiyun Gao and Shuzheng Gao and Yang Xiao and Michael R. Lyu},
booktitle = {ISSTA},
year = {2024},
doi = {10.1145/3650212.3652124}
}