Vulnerability detection via typestate-guided code representation learning

Machine learning, including deep learning, has found success in various domains. Recently, the focus has shifted to using deep learning, like graph neural networks, for static vulnerability detection. Existing methods represent code as an embedding vector and train models on safe and vulnerable code patterns to predict vulnerabilities. However, these models lack precise bug detection, as they prioritize coarse-grained classification over understanding vulnerability semantics, such as typestate properties. This paper introduces an innovative typestate-guided code embedding technique for accurate static vulnerability detection. We select and retain feasible typestate sequences extracted from typestate analysis using self-supervised contrastive learning in a pretrained path embedding model. This reduces the need for labeled data in training downstream models for vulnerability detection. Evaluation on real-world projects showcases our approach’s superiority over recent learning-based approaches. It outperforms them by substantial margins across various metrics like precision, recall and F1 Score.