FiCoVuL: A Framework for Fine-grained and Cross-function Code Vulnerability Detection

Abstract

Detecting vulnerabilities in software development is crucial yet challenging. Deep learning-based approaches have shown promise in automatically learning features for vulnerable function detection. In practice, human analysts need to correlate the behavioral logic of multiple functions to confirm the occurrence of vulnerabilities. However, existing works fail to consider the contextual information across functions. Furthermore, human analysts expect models to provide finer-grained explanations to assist in the fixing process. In this paper, we present FiCoVuL, a framework for analyzing interconnected functions and providing fine-grained guidance for vulnerability fixing. FiCoVuL utilizes Function Fusion to extract function definitions and their call relationships from a project, and synthesize multiple functions into one for joint analysis. It models code as a multi-relational graph, capturing rich syntactic and semantic relationships between code statements. A multi-relational graph attention network is leveraged to perform message passing between nodes and edge relationships, generating graph-level and node-level representations. These representations are utilized for vulnerability function prediction and code line ranking, assisting in vulnerability fixing. We evaluate FiCoVuL on a public vulnerability dataset and a self-constructed cross-function one, and compare it with five existing detection models. Experimental results show that FiCoVuL significantly outperforms other methods in both vulnerability detection and localization.