Software Vulnerability Detection Using an Enhanced Generalization Strategy

Detecting vulnerabilities in software is crucial for preventing cybersecurity attacks, and current machine learning-based methods rely on large amounts of labeled data to train detection models. On the one hand, a major assumption is that the training and test data follow an identical distribution. However, vulnerabilities in different software projects may exhibit various distributions due to their application scenarios, coding habits, and other factors. On the other hand, when detecting vulnerabilities in new projects, it is time-consuming to retrain and test the models. Especially for new projects being developed, it has few or no instances of vulnerabilities. Therefore, how to leverage previous learning experience to learn new projects faster is important. To address these issues, we propose VulGML, a vulnerability detection approach using graph embedding and meta-learning. The goal is to establish a model with enhanced generalization, so that the model trained on multiple known projects can detect vulnerabilities in new projects. To further illustrate the strong generalization of VulGML, we also choose multiple known vulnerability types to train the meta-learning model and a new vulnerability type for vulnerability detection. Experimental results show that VulGML outperforms the state-of-the-art methods by 6.44–39.61% in detecting new projects, achieves an accuracy higher than 77.80% when detecting vulnerabilities in new vulnerability types, and its modules have greatly improved detection performance, demonstrating that VulGML is potentially valuable in practical usage.