Abstract
Software vulnerability detection has emerged as a significant concern in the field of software security recently, capturing the attention of numerous researchers and developers. Most previous approaches focus on coarse-grained vulnerability detection, such as at the function or file level. However, the developers would still encounter the challenge of manually inspecting a large volume of code inside the vulnerable function to identify the specific vulnerable statements for modification, indicating the importance of vulnerability localization. Training the model for vulnerability localization usually requires ground-truth labels at the statement-level, and labeling vulnerable statements demands expert knowledge, which incurs high costs. Hence, the demand for an approach that eliminates the need for additional labeling at the statement-level is on the rise. To tackle this problem, we propose a novel approach called WAVES for WeAkly supervised Vulnerability Localization via multiplE inStance learning, which does not need the additional statement-level labels during the training. WAVES has the capability to determine whether a function is vulnerable (i.e., vulnerability detection) and pinpoint the vulnerable statements (i.e., vulnerability localization). Specifically, inspired by the concept of multiple instance learning, WAVES converts the ground-truth label at the function-level into pseudo labels for individual statements, eliminating the need for additional statement-level labeling. These pseudo labels are utilized to train the classifiers for the function-level representation vectors. Extensive experimentation on three popular benchmark datasets demonstrates that, in comparison to previous baselines, our approach achieves comparable performance in vulnerability detection and state-of-the-art performance in statement-level vulnerability localization.
Abstract (translated)
近期，软件漏洞检测已成为软件安全领域的一个重要议题，吸引了众多研究人员和开发者的关注。以往的大多数方法主要集中在粗粒度的漏洞检测上，例如在函数或文件级别进行检测。然而，开发人员仍面临手动检查脆弱功能内部大量代码以识别需修改的具体脆弱语句这一挑战，这表明了漏洞定位的重要性。为了训练用于漏洞定位的模型，通常需要具有语句级别的真实标签，并且标注脆弱语句则需要专家知识，从而产生了高昂的成本。因此，对无需额外进行语句级标注的方法的需求日益增长。 为了解决这个问题，我们提出了一种新颖的方法叫做 WAVES（通过多实例学习进行弱监督漏洞定位），该方法在训练过程中不需要额外的语句级别标签。WAVES具有判断一个函数是否脆弱（即漏洞检测）以及确定具体的脆弱语句（即漏洞定位）的能力。具体来说，受多重实例学习概念的启发，WAVES将函数级别的真实标签转换为单个语句的伪标签，从而消除了对额外语句级别标注的需求。这些伪标签被用来训练用于函数级表示向量的分类器。 在三个流行基准数据集上的广泛实验表明，与之前的基线方法相比，我们的方法在漏洞检测方面取得了可比性能，在语句级别的漏洞定位方面达到了当前最佳水平。
URL
https://arxiv.org/abs/2509.11312
