Deep Learning (DL)-based methods have proven to be effective for software vulnerability detection, with a potential for substantial productivity enhancements for detecting vulnerabilities. Current methods mainly focus on detecting single functions (i.e., intra-procedural vulnerabilities), ignoring the more complex inter-procedural vulnerability detection scenarios in practice. For example, developers routinely engage with program analysis to detect vulnerabilities that span multiple functions within repositories. In addition, the widely-used benchmark datasets generally contain only intra-procedural vulnerabilities, leaving the assessment of inter-procedural vulnerability detection capabilities unexplored.
To mitigate the issues, we propose a repository-level evaluation system, named \textbf{VulEval}, aiming at evaluating the detection performance of inter- and intra-procedural vulnerabilities simultaneously. Specifically, VulEval consists of three interconnected evaluation tasks: \textbf{(1) Function-Level Vulnerability Detection}, aiming at detecting intra-procedural vulnerability given a code snippet; \textbf{(2) Vulnerability-Related Dependency Prediction}, aiming at retrieving the most relevant dependencies from call graphs for providing developers with explanations about the vulnerabilities; and \textbf{(3) Repository-Level Vulnerability Detection}, aiming at detecting inter-procedural vulnerabilities by combining with the dependencies identified in the second task. VulEval also consists of a large-scale dataset, with a total of 4,196 CVE entries, 232,239 functions, and corresponding 4,699 repository-level source code in C/C++ programming languages. Our analysis highlights the current progress and future directions for software vulnerability detection.
DREA: Decoupled Reasoning and Exploration Agents for Repository-Level Vulnerability Detection
Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；School of Cyber Security, University of Chinese Academy of Sciences（中国科学院大学网络安全学院）
CyberForge: Verified Vulnerability Injection at Repository Level for Cybersecurity Agent Training
National Institute of Standards and Technology（美国国家标准与技术研究院）；Université Grenoble Alpes（格勒诺布尔阿尔卑斯大学）；CNRS（法国国家科学研究中心）；University of Maryland, College Park（马里兰大学帕克分校）
Knowdit: Agentic Smart Contract Vulnerability Detection with Auditing Knowledge Summarization
Nanyang Technological University（南洋理工大学）；National Superior College for Engineers, Beihang University（北京航空航天大学高等工程学院）；Bitslab；The Chinese University of Hong Kong（香港中文大学）
A Systematic Literature Review on Detecting Software Vulnerabilities with Large Language Models
Esslingen University（埃斯林根大学）；Institute for Intelligent Systems, Esslingen University（智能系统研究所，埃斯林根大学）；Chair of Communication Networks, University of Tübingen（通信网络教研室，图宾根大学）
