MVD：一种多语言软件漏洞检测框架
MVD: A Multi-Lingual Software Vulnerability Detection Framework
AI总结：
针对现有漏洞检测方法多聚焦单语言、未利用跨语言知识协同的问题，提出多语言漏洞检测框架MVD，通过多语言数据联合学习与增量学习实现跨语言检测，在11K+漏洞数据集上PR-AUC较SOTA提升83.7%-193.6%。
摘要：
软件漏洞可能引发灾难性网络攻击，对商业运营的威胁与日俱增。因此，确保软件系统的安全已成为私营和公共部门的首要关切。近年来的研究中，基于学习的软件漏洞检测方法得到越来越多的探索。然而，这些技术的一个关键局限是主要聚焦于单一编程语言（如C/C++），考虑到现代软件项目的多语言特性，这一局限带来了诸多限制。此外，现有研究似乎忽视了利用跨不同语言的漏洞知识协同效应，可能未充分发挥这些方法的全部能力。为解决上述问题，我们提出了MVD——一种创新的多语言漏洞检测框架。该框架通过同时学习由我们的专用流水线整理的多语言漏洞数据，获得了跨多种语言检测漏洞的能力。我们还引入了增量学习，使MVD的检测能力可扩展至新语言，从而提升了其实用性。我们整理了包含超过11000个真实世界多语言漏洞的数据集，在该数据集上开展的大量实验证实，我们的框架在多语言漏洞检测的PR-AUC指标上，较当前最优方法显著提升了83.7%至193.6%。结果还表明，即使旧语言的训练数据不可用，MVD也能很好地检测新语言的漏洞，且不会损害此前已训练语言的检测性能。总体而言，我们的研究结果为现代软件系统中的多语言漏洞预测提供了动力并铺平了道路。
英文摘要：
Software vulnerabilities can result in catastrophic cyberattacks that increasingly threaten business operations. Consequently, ensuring the safety of software systems has become a paramount concern for both private and public sectors. Recent literature has witnessed increasing exploration of learning-based approaches for software vulnerability detection. However, a key limitation of these techniques is their primary focus on a single programming language, such as C/C++, which poses constraints considering the polyglot nature of modern software projects. Further, there appears to be an oversight in harnessing the synergies of vulnerability knowledge across varied languages, potentially underutilizing the full capabilities of these methods. To address the aforementioned issues, we introduce MVD - an innovative multi-lingual vulnerability detection framework. This framework acquires the ability to detect vulnerabilities across multiple languages by concurrently learning from vulnerability data of various languages, which are curated by our specialized pipeline. We also incorporate incremental learning to enable the detection capability of MVD to be extended to new languages, thus augmenting its practical utility. Extensive experiments on our curated dataset of more than 11K real-world multi-lingual vulnerabilities substantiate that our framework significantly surpasses state-of-the-art methods in multi-lingual vulnerability detection by 83.7% to 193.6% in PR-AUC. The results also demonstrate that MVD detects vulnerabilities well for new languages without compromising the detection performance of previously trained languages, even when training data for the older languages is unavailable. Overall, our findings motivate and pave the way for the prediction of multi-lingual vulnerabilities in modern software systems.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
