Learning Program Semantics for Vulnerability Detection via Vulnerability-Specific Inter-procedural Slicing

"Recently, the learning-based approaches that learn code representations for software vulnerability detection have been proven to produce inspiring results. However, they still suffer from some limitations. On one hand, some learning-based works learn code representation on a single function for vulnerability detection, which ignore the fact that some vulnerabilities span multiple functions. On the other hand, other works attempt to leverage slicing techniques to extract the program semantics of vulnerable parts to generate code representations for vulnerability detection but fail to slice out precise vulnerable parts due to the wide variety of vulnerabilities that cannot be accurately captured by one general slicing algorithm. To address the limitations, in this paper, we propose a learning-based approach namely SnapVuln, which utilizes multiple type-specific inter-procedural slicing algorithms that operate on inter-procedural graphs to capture precise program semantics of various vulnerability types and leverages a Gated Graph Neural Network (GGNN) with an attention mechanism to learn graph structure information and assign different weights to different program semantics for code representation generation. We conduct extensive experiments on two public datasets, and compare SnapVuln with five state-of-the-art learning-based vulnerability detection approaches and two pre-trained approaches. Experimental results show that SnapVuln outperforms these baselines. We further perform an ablation study to demonstrate that the completeness and precision of vulnerability semantics captured by SnapVuln contribute to the improvement of vulnerability detection."