An Empirical Study of Vulnerability Detection using Federated Learning

TL;DR

This paper evaluates federated learning's effectiveness in vulnerability detection, demonstrating its potential to improve detection performance across various CWEs while highlighting challenges posed by data heterogeneity.

Contribution

It introduces VulFL, a comprehensive evaluation framework for FL-based vulnerability detection, and provides an extensive study on FL's capabilities and configuration strategies for this task.

Findings

FL significantly improves vulnerability detection performance over independent training.

Data heterogeneity limits FL effectiveness in vulnerability detection.

Configuration strategies impact FL performance in vulnerability detection.

Abstract

Although Deep Learning (DL) methods becoming increasingly popular in vulnerability detection, their performance is seriously limited by insufficient training data. This is mainly because few existing software organizations can maintain a complete set of high-quality samples for DL-based vulnerability detection. Due to the concerns about privacy leakage, most of them are reluctant to share data, resulting in the data silo problem. Since enables collaboratively model training without data sharing, Federated Learning (FL) has been investigated as a promising means of addressing the data silo problem in DL-based vulnerability detection. However, since existing FL-based vulnerability detection methods focus on specific applications, it is still far unclear i) how well FL adapts to common vulnerability detection tasks and ii) how to design a high-performance FL solution for a specific vulnerability detection task. To answer these two questions, this paper first proposes VulFL, an effective evaluation framework for FL-based vulnerability detection. Then, based on VulFL, this paper conducts a comprehensive study to reveal the underlying capabilities of FL in dealing with different types of CWEs, especially when facing various data heterogeneity scenarios. Our experimental results show that, compared to independent training, FL can significantly improve the detection performance of common AI models on all investigated CWEs, though the performance of FL-based vulnerability detection is limited by heterogeneous data. To highlight the performance differences between different FL solutions for vulnerability detection, we extensively investigate the impacts of different configuration strategies for each framework component of VulFL. Our study sheds light on the potential of FL in vulnerability detection, which can be used to guide the design of FL-based solutions for vulnerability detection.