Leveraging Self-Paced Learning for Software Vulnerability Detection

Vulnerabilities are major risks to software systems. Researchers have proposed many deep learning approaches to detect software vulnerabilities. However, their accuracy is limited in practice. One of the main causes is low-quality samples ( i . e ., source code and its label) in the training set. To this end, we propose a new approach: SPLVD ( S elf- P aced L earning for S oftware V ulnerability D etection). SPLVD dynamically selects samples based on the training stage, which simulates the easy-to-hard human learning process. SPLVD has a data selector specifically designed for vulnerability detection. Before each training epoch, SPLVD uses the data selector to calculate the difficulty of each sample, select parts of samples for training, and update the data selector. When evaluating SPLVD, we first use three well-known datasets (BigVul, Devign, and ReVeal) containing more than 239K samples, of which 25K are vulnerable. Experimental results demonstrate that SPLVD achieves the highest F1 of 89.2% on BigVul, 68.7% on Devign, and 43.5% on ReVeal, respectively, outperforming the state-of-the-art approaches. Moreover, we collect samples from OpenHarmony, a new ecosystem that has not been learned by general large language models, to evaluate SPLVD. SPLVD achieves the highest precision of 90.9%, demonstrating its effectiveness in real-world applications.