一句话：提出GVI，用思维链提示引导LLM从种子漏洞想象生成新漏洞样本，缓解类别不平衡并提升深度检测器性能。
深度漏洞检测器多依赖监督学习，需要大规模高质量漏洞数据集，但漏洞数据天然存在严重类别不平衡：漏洞样本远少于非漏洞样本，从而削弱检测器效果。人工生成漏洞样本是缓解该问题的有前景思路，然而现有生成技术要么对真实漏洞的刻画不足，要么需要大规模漏洞样本训练生成模型。本文提出GVI，借鉴人类通过想象进行学习的方式，探索利用LLM从给定种子漏洞出发想象并创建新的、具有信息量的漏洞样本。具体而言，GVI设计了受思维链启发的提示：先指导LLM分析种子漏洞并抽取漏洞相关属性，再依据这些属性生成一组新漏洞。在Devign、ReVeal、BigVul三个数据集以及Devign、ReVeal、LineVul三个深度漏洞检测器上的大量实验表明，GVI生成的漏洞样本不仅更准确，而且在增强深度漏洞检测器性能方面更有效。
The use of deep learning to achieve automated software vulnerability detection has been a longstanding interest within the software security community. These deep vulnerability detectors are mostly trained in a supervised manner, which heavily relies on large-scale, high-quality vulnerability datasets. However, the vulnerability datasets used to train deep vulnerability detectors frequently exhibit class imbalance due to the inherent nature of vulnerability data, where vulnerable cases are significantly rarer than non-vulnerable cases. This imbalance adversely affects the effectiveness of these detectors. A promising solution to address the class imbalance problem is to artificially generate vulnerable samples to enhance vulnerability datasets, yet existing vulnerability generation techniques are not satisfactory due to their inadequate representation of real-world vulnerabilities or their reliance on large-scale vulnerable samples for training the generation model. This paper proposes G VI, a novel approach aimed at generating vulnerable samples to boost deep vulnerability detectors. G VI takes inspiration from human learning with imagination and proposes exploring LLMs to imagine and create new, informative vulnerable samples from given seed vulnerabilities. Specifically, we design a Chain-of-Thought inspired prompt in GVI that instructs the LLMs to first analyze the seed to retrieve attributes related to vulnerabilities and then generate a set of vulnerabilities based on the seed's attributes. Our extensive experiments on three vulnerability datasets (i.e., Devign, ReVeal, and BigVul) and across three deep vulnerability detectors (i.e., Devign, Re Veal, and Line Vul) demonstrate that the vulnerable samples generated by G VI are not only more accurate but also more effective in enhancing the performance of deep vulnerability detectors.
DOI 原文 ·
@inproceedings{paperbot8917,
title = {GVI: Guided Vulnerability Imagination for Boosting Deep Vulnerability Detectors},
author = {Heng Yong and Zhong Li and Minxue Pan and Tian Zhang and Jianhua Zhao and Xuandong Li},
booktitle = {ICSE},
year = {2025},
doi = {10.1109/icse55347.2025.00214}
}