A Source Code Vulnerability Detection Method Based on Positive-Unlabeled Learning

As the scale of modern software continues to expand, the risk of software being attacked also increases. Software vulnerabilities are the primary cause of these risks. Traditional detection methods rely on expert knowledge and are difficult to meet the complex needs of today. In recent years, with the development of pre-trained models, some researchers have applied these models to the field of code vulnerability detection. However, pre-trained models require large amounts of labeled data, which is often difficult to obtain and ensure its quality. Therefore, how to effectively detect code vulnerabilities in a weakly supervised setting remains an important challenge. This paper presents PU-CBVD, a source code vulnerability detection model built on the pre-trained CodeBERT model. PU-CBVD utilizes abundant unlabeled data alongside a limited set of labeled samples, generating pseudo-labels for the unlabeled data. The combined dataset is then input into a pre-trained model, enhanced with a Gated Graph Neural Network (GGNN) for feature extraction and training, resulting in an effective source code vulnerability detection model. To evaluate its performance, we compared our model with existing weakly supervised learning methods and popular supervised vulnerability detection approaches. Experimental results show that our model significantly outperforms existing models.