Detecting Source Code Vulnerabilities using High-Precision Code Representation and Bimodal Contrastive Learning

Deep Learning is employed in the field of code vulnerability detection by modeling code semantics and utilizing programming language learning models to convert program features into numeric vectors for classification within the detection model. In the program semantic modeling step, two popular approaches are static analysis and dynamic analysis. Traditional static analysis tools tend to introduce non-executable paths, leading to a high false positive rate, while dynamic analysis methods like fuzzing are usually hampered by low code coverage rates, resulting in a high false negative rate. To address these issues, we suggest a hybrid program semantic representation based on static analysis and symbolic execution. Additionally, many state-of-the-art methods commonly use token-based models to convert code semantic features into numerical vectors. However, these models tend to optimize tokens that occur very frequently in the training datas and ignore the features of less frequent tokens. Therefore, we introduce bimodal contrastive learning to enhance token-based pre-training models. Additionally, we collected vulnerable and non-vulnerable code from the SARD dataset and the opensource repository GitHub. We extracted code semantic features and manually labeled the code to build training and testing datasets. Experiments conducted on these datasets demonstrated that our approach exhibits superior detection performance. In summary, we propose a new method called VulnGuard, which comprehensively considers both the static characteristics and dynamic behavior of programs. By utilizing bimodal contrastive learning techniques, it more accurately captures the various semantics of programs, ultimately improving the accuracy of vulnerability detection.