Information-theoretic Source Code Vulnerability Highlighting

• Main Authors: Nguyen, Van, Le, Trung, De Vel, Olivier, Montague, Paul, Grundy, John, Phung, Dinh
• Format: Conference Proceeding
• Language: English
• Subjects: Codes; Deep learning; Feature extraction; Industries; Neural networks; Predictive models; Software
• ISSN: 2161-4407
• DOI: 10.1109/IJCNN52387.2021.9533907

Software vulnerabilities are a crucial and serious concern in the software industry and computer security. A variety of methods have been proposed to detect vulnerabilities in real-world software. Recent methods based on deep learning approaches for automatic feature extraction have improved software vulnerability identification compared with machine learning approaches based on hand-crafted feature extraction. However, these methods can usually only detect software vulnerabilities at a function or program level, which is much less informative because, out of hundreds (thousands) of code statements in a program or function, only a few core statements contribute to a software vulnerability. This requires us to find a way to detect software vulnerabilities at a fine-grained level. In this paper, we propose a novel method based on the concept of mutual information that can help us to detect and isolate software vulnerabilities at a fine-grained level (i.e., several statements that are highly relevant to a software vulnerability that include the core vulnerable statements) in both unsupervised and semi-supervised contexts. We conduct comprehensive experiments on real-world software projects to demonstrate that our proposed method can detect vulnerabilities at a fine-grained level by identifying several statements that mostly contribute to the vulnerability detection decision.