CVulDetector: Cross-domain Vulnerability Detection Based on Transfer Learning

Software vulnerabilities pose a significant threat to computer security, and accurate identification of vulnerabilities has become a challenging task. Although previous work on deep learning-based vulnerability detection has achieved some success, it still faces issues such as 1) insufficient feature extraction capability of the models, and 2) unrealistic assumption of identical distribution between the source and target domains. To address these problems, we propose CVulDetector, a cross-domain vulnerability detection scheme based on transfer learning. Our approach incorporates both natural language characteristics and semantic syntax information of programs, enabling a more comprehensive description of program features. By employing two neural network models, we extract vulnerability-rich features and fine-tune the model using limited labeled data from the target domain after pre-training on a wide range of features from the source domain. Experimental evaluation on three CWE datasets shows an F1-score of 90.6%.