Challenges in Using Code LMs for Vulnerability Detection

In recent years, there has been a growing interest in using code language models (code LMs) to find Vulnerabilities in software code. Code LMs are advanced programs trained to understand and generate code, and researchers believe they can help identify security issues in software more effectively. However, the tools and methods currently available for this task have some serious limitations. This article discusses the main problems with existing methods and suggests a new approach to improve how we detect vulnerabilities in code.

#The Importance of Finding Vulnerabilities

Software vulnerabilities can lead to serious security issues, making it essential to identify them before they can be exploited. As software becomes more complex, traditional methods of finding vulnerabilities are not enough. Code LMs can automate some of these tasks, potentially speeding up the process and improving the accuracy of vulnerability detection.

#Problems with Existing Datasets

One of the main challenges in using code LMs for vulnerability detection is the quality of the data they are trained on. Current datasets used for training often have significant flaws:

#Poor Data Quality

Many existing datasets suffer from low quality due to inaccurate labeling and high duplication rates. Essentially, if the data used to train a model is flawed, the model's predictions will also likely be unreliable. For example, datasets that are labeled automatically may misclassify benign code as vulnerable or miss actual vulnerabilities altogether.

#Low Label Accuracy

Label accuracy refers to how correctly the code in the dataset is identified as vulnerable or benign. Studies show that many datasets have label accuracy rates of only 25% to 60%. This means that there is a considerable amount of incorrect information in these datasets, which directly affects how well code LMs can detect vulnerabilities in real-world scenarios.

#High Duplication Rates

Duplication in datasets occurs when the same pieces of code are repeated. This can lead to a misleading sense of effectiveness when evaluating a model's performance, as it might appear to do well simply because it has "seen" the same problems before. In some cases, up to 18.9% of test samples were found to be duplicates of training samples, compromising the evaluation process.

#Issues with Evaluation Methods

The methods used to evaluate how well code LMs detect vulnerabilities also have shortcomings. Many studies focus solely on accuracy or F1 scores, but these metrics do not give a complete picture of a model's capability in real-world situations. For example, a model could achieve high accuracy by predicting that most cases are non-vulnerable, as vulnerabilities are relatively rare in practice. This does not mean the tool is actually effective in detecting real vulnerabilities.

#Need for Better Labeling Techniques

To tackle these issues, developers need better labeling techniques that can accurately reflect the actual status of code vulnerabilities. Current automatic labeling methods rely too heavily on flawed assumptions, leading to additional inaccuracies in labeled data. A potential solution is manual labeling, which, while more accurate, is labor-intensive and not scalable for larger datasets.

#Introduction of a New Dataset

To combat the flaws of existing datasets, a new dataset has been proposed. This new dataset aims to provide high-quality labeled data for training code LMs. It incorporates improved labeling techniques that focus on human verification, ensuring that the labeled vulnerabilities are as accurate as possible.

#Improved Labeling Techniques

Two new labeling methods have been introduced: OneFunc and NVDCheck. These methods aim to label functions accurately based on expert analysis and the references found in the National Vulnerability Database (NVD). The goal is to reduce label noise and improve the overall quality of the dataset.

#Comprehensive Data Collection

The new dataset has also taken steps to merge data from various sources while thoroughly removing duplicates. By doing so, it ensures that each function is only considered once, offering a more realistic set of training and testing data.

#New Evaluation Guidelines

With a new dataset in place, it is crucial to establish evaluation guidelines that better reflect real-world performance. The objective is to provide a framework that not only measures how well models do on a given dataset but also assesses their effectiveness when applied to new, unseen data.

#Chronological Splitting of Data

One of the key improvements in evaluation methods is the chronological splitting of data. This process involves dividing the dataset based on when the code was committed, allowing models to be trained on older data and tested on more recent code. This approach mimics real-world conditions more closely.

#Introduction of a New Metric

A new performance metric, called the Vulnerability Detection Score (VD-S), has been introduced. This score focuses on measuring how well models can identify actual vulnerabilities while maintaining a manageable false-positive rate. The idea is to ensure that the models are not just effective in finding vulnerabilities but do so without overwhelming developers with false alarms.

#Pair-wise Evaluation Approach

A pair-wise evaluation method has also been implemented to examine how well models can differentiate between vulnerable and benign code samples. By comparing pairs of functions that are similar, researchers can better assess a model's understanding of vulnerabilities rather than just its ability to recognize text patterns.

#Evaluation of Code LMs

The new dataset and evaluation guidelines were used to assess various existing code LMs. The results highlighted a significant gap between the performance of these models and the real-world requirements for vulnerability detection.

#Discrepancy in Performance

Many code LMs showed poor performance on the new dataset compared to earlier evaluations, revealing that results from prior benchmarks were overly optimistic. For instance, the state-of-the-art model, StarCoder2, which had previously shown a high F1 score on another dataset, performed terribly on the new dataset.

#Attempts to Improve Performance

To better understand how code LMs can be improved, researchers explored advanced training techniques, including class weighting and contrastive learning. However, these efforts did not lead to significant performance gains.

#Class Weighting

The introduction of class weights aimed to help models better handle the imbalance between vulnerable and benign samples. While this technique showed some improvement, it was not sufficient to bridge the performance gap.

#Contrastive Learning

Contrastive learning was also tested as a method to enhance model performance. This technique encourages models to differentiate between dissimilar samples. Yet, even with this approach, the underlying issues with the models' capabilities remained.

#Exploring Larger Models

Researchers turned their attention to larger language models, such as GPT-3.5 and GPT-4, to see if their increased complexity would lead to better performance in detecting vulnerabilities. While these models outperformed smaller ones, they still struggled to make accurate predictions.

#Conclusion

The study of code LMs for vulnerability detection reveals that current models fall short in real-world applications. Despite various attempts to improve their performance through more reliable datasets and advanced methodologies, these models have not yet reached a level of effectiveness needed for practical deployment.

#Future Directions

There is a need for continued research to develop fundamentally new approaches for training code LMs and evaluating their effectiveness. Emphasis should be placed not just on improving existing methods but also on exploring innovative techniques that genuinely enhance the ability of these models to understand and detect software vulnerabilities.