Coca: Improving and explaining graph neural network-based vulnerability detection systems
Recently, Graph Neural Network (GNN)-based vulnerability detection systems have achieved remarkable success. However, the lack of explainability poses a critical challenge to deploy black-box models in security-related domains. For this reason, several approaches have been proposed to explain the de...
Saved in:
Main Authors: | , , , , , , |
---|---|
Format: | text |
Language: | English |
Published: |
Institutional Knowledge at Singapore Management University
2024
|
Subjects: | |
Online Access: | https://ink.library.smu.edu.sg/sis_research/9250 https://ink.library.smu.edu.sg/context/sis_research/article/10250/viewcontent/2401.14886v1.pdf |
Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
Institution: | Singapore Management University |
Language: | English |
id |
sg-smu-ink.sis_research-10250 |
---|---|
record_format |
dspace |
spelling |
sg-smu-ink.sis_research-102502024-09-02T06:40:24Z Coca: Improving and explaining graph neural network-based vulnerability detection systems CAO, Sicong SUN, Xiaobing WU, Xiaoxue LO, David BO, Lili LI, Bin LIU, Wei Recently, Graph Neural Network (GNN)-based vulnerability detection systems have achieved remarkable success. However, the lack of explainability poses a critical challenge to deploy black-box models in security-related domains. For this reason, several approaches have been proposed to explain the decision logic of the detection model by providing a set of crucial statements positively contributing to its predictions. Unfortunately, due to the weakly-robust detection models and suboptimal explanation strategy, they have the danger of revealing spurious correlations and redundancy issue.In this paper, we propose Coca, a general framework aiming to 1) enhance the robustness of existing GNN-based vulnerability detection models to avoid spurious explanations; and 2) provide both concise and effective explanations to reason about the detected vulnerabilities. Coca consists of two core parts referred to as Trainer and Explainer. The former aims to train a detection model which is robust to random perturbation based on combinatorial contrastive learning, while the latter builds an explainer to derive crucial code statements that are most decisive to the detected vulnerability via dual-view causal inference as explanations. We apply Coca over three typical GNN-based vulnerability detectors. Experimental results show that Coca can effectively mitigate the spurious correlation issue, and provide more useful high-quality explanations. 2024-04-01T07:00:00Z text application/pdf https://ink.library.smu.edu.sg/sis_research/9250 info:doi/10.1145/3597503.3639168 https://ink.library.smu.edu.sg/context/sis_research/article/10250/viewcontent/2401.14886v1.pdf http://creativecommons.org/licenses/by-nc-nd/4.0/ Research Collection School Of Computing and Information Systems eng Institutional Knowledge at Singapore Management University Contrastive Learning Causal Inference Explainability Graphics and Human Computer Interfaces OS and Networks Software Engineering |
institution |
Singapore Management University |
building |
SMU Libraries |
continent |
Asia |
country |
Singapore Singapore |
content_provider |
SMU Libraries |
collection |
InK@SMU |
language |
English |
topic |
Contrastive Learning Causal Inference Explainability Graphics and Human Computer Interfaces OS and Networks Software Engineering |
spellingShingle |
Contrastive Learning Causal Inference Explainability Graphics and Human Computer Interfaces OS and Networks Software Engineering CAO, Sicong SUN, Xiaobing WU, Xiaoxue LO, David BO, Lili LI, Bin LIU, Wei Coca: Improving and explaining graph neural network-based vulnerability detection systems |
description |
Recently, Graph Neural Network (GNN)-based vulnerability detection systems have achieved remarkable success. However, the lack of explainability poses a critical challenge to deploy black-box models in security-related domains. For this reason, several approaches have been proposed to explain the decision logic of the detection model by providing a set of crucial statements positively contributing to its predictions. Unfortunately, due to the weakly-robust detection models and suboptimal explanation strategy, they have the danger of revealing spurious correlations and redundancy issue.In this paper, we propose Coca, a general framework aiming to 1) enhance the robustness of existing GNN-based vulnerability detection models to avoid spurious explanations; and 2) provide both concise and effective explanations to reason about the detected vulnerabilities. Coca consists of two core parts referred to as Trainer and Explainer. The former aims to train a detection model which is robust to random perturbation based on combinatorial contrastive learning, while the latter builds an explainer to derive crucial code statements that are most decisive to the detected vulnerability via dual-view causal inference as explanations. We apply Coca over three typical GNN-based vulnerability detectors. Experimental results show that Coca can effectively mitigate the spurious correlation issue, and provide more useful high-quality explanations. |
format |
text |
author |
CAO, Sicong SUN, Xiaobing WU, Xiaoxue LO, David BO, Lili LI, Bin LIU, Wei |
author_facet |
CAO, Sicong SUN, Xiaobing WU, Xiaoxue LO, David BO, Lili LI, Bin LIU, Wei |
author_sort |
CAO, Sicong |
title |
Coca: Improving and explaining graph neural network-based vulnerability detection systems |
title_short |
Coca: Improving and explaining graph neural network-based vulnerability detection systems |
title_full |
Coca: Improving and explaining graph neural network-based vulnerability detection systems |
title_fullStr |
Coca: Improving and explaining graph neural network-based vulnerability detection systems |
title_full_unstemmed |
Coca: Improving and explaining graph neural network-based vulnerability detection systems |
title_sort |
coca: improving and explaining graph neural network-based vulnerability detection systems |
publisher |
Institutional Knowledge at Singapore Management University |
publishDate |
2024 |
url |
https://ink.library.smu.edu.sg/sis_research/9250 https://ink.library.smu.edu.sg/context/sis_research/article/10250/viewcontent/2401.14886v1.pdf |
_version_ |
1814047844774969344 |