arXiv:2504.15632cs.SEcs.CR2025-04中稿 · EASE 2025, Istanbu…被引 1

用代码嵌入增强提升漏洞检测,效果接近传统采样法。

A Study on Mixup-Inspired Augmentation Methods for Software Vulnerability Detection

  • 在代码嵌入层进行数据增强,避免手动构造漏洞
  • 最高使F1分数提升9.67%,优于多数现有方法
  • 适合资源有限、数据稀少的漏洞检测场景

近年来深度学习被广泛用于软件漏洞检测。但真实漏洞数据稀缺且难以获取,因缺乏明确的分类标准;现有数据集严重不平衡,且对深度学习模型而言规模仍偏小。此前工作尝试基于源码生成单语句漏洞,但不实用且需人工验证。本文首次探索在表示层进行漏洞数据增强,以帮助模型更好学习。我们实现了并评估了五种近期用于代码搜索的嵌入增强技术,并引入条件版本,确保增强不改变向量中漏洞部分。实验表明,这些方法可有效提升性能,最高使F1分数提高9.67%;但尚未超越随机过采样(提升10.82%)。

原文摘要 · Abstract (English)

Various deep learning (DL) methods have recently been utilized to detect software vulnerabilities. Real-world software vulnerability datasets are rare and hard to acquire, as there is no simple metric for classifying vulnerability. Such datasets are heavily imbalanced, and none of the current datasets are considered huge for DL models. To tackle these problems, a recent work has tried to augment the dataset using the source code and generate realistic single-statement vulnerabilities, which is not quite practical and requires manual checking of the generated vulnerabilities. In this paper, we aim to explore the augmentation of vulnerabilities at the representation level to help current models learn better, which has never been done before to the best of our knowledge. We implement and evaluate five augmentation techniques that augment the embedding of the data and have recently been used for code search, which is a completely different software engineering task. We also introduced a conditioned version of those augmentation methods, which ensures the augmentation does not change the vulnerable section of the vector representation. We show that such augmentation methods can be helpful and increase the F1-score by up to 9.67%, yet they cannot beat Random Oversampling when balancing datasets, which increases the F1-score by 10.82%.

漏洞检测数据增强代码嵌入

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。