Learning to Locate: GNN-Powered Vulnerability Path Discovery in Open Source Code

TL;DR

VulPathFinder is a GNN-based framework that improves vulnerability path discovery in open-source code by accurately locating vulnerable statements and explaining root causes, outperforming existing methods.

Contribution

The paper introduces VulPathFinder, a novel GNN-powered approach that enhances vulnerability path detection and explanation over rule-based methods like SliceLocator.

Findings

VulPathFinder outperforms SliceLocator and GNNExplainer in vulnerability path discovery.

The GNN effectively captures semantic and syntactic dependencies for sink statement detection.

The approach provides clear explanations for detected vulnerabilities.

Abstract

Detecting security vulnerabilities in open-source software is a critical task that is highly regarded in the related research communities. Several approaches have been proposed in the literature for detecting vulnerable codes and identifying the classes of vulnerabilities. However, there is still room to work in explaining the root causes of detected vulnerabilities through locating vulnerable statements and the discovery of paths leading to the activation of the vulnerability. While frameworks like SliceLocator offer explanations by identifying vulnerable paths, they rely on rule-based sink identification that limits their generalization. In this paper, we introduce VulPathFinder, an explainable vulnerability path discovery framework that enhances SliceLocator's methodology by utilizing a novel Graph Neural Network (GNN) model for detecting sink statements, rather than relying on predefined rules. The proposed GNN captures semantic and syntactic dependencies to find potential sink points (PSPs), which are candidate statements where vulnerable paths end. After detecting PSPs, program slicing can be used to extract potentially vulnerable paths, which are then ranked by feeding them back into the target graph-based detector. Ultimately, the most probable path is returned, explaining the root cause of the detected vulnerability. We demonstrated the effectiveness of the proposed approach by performing evaluations on a benchmark of the buffer overflow CWEs from the SARD dataset, providing explanations for the corresponding detected vulnerabilities. The results show that VulPathFinder outperforms both original SliceLocator and GNNExplainer (as a general GNN explainability tool) in discovery of vulnerability paths to identified PSPs.