Dual-View Causal Reasoning for Explainable Vulnerability Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing deep learning-based vulnerability detection methods in software are prone to black-box nature, weak robustness, and generate non-concise explanations that require significant manual audit, lacking robustness and accuracy in identifying and explaining software vulnerabilities.
Innovation Solution
An explainable vulnerability detection method and system using dual-view causal reasoning, involving data augmentation, static analysis, code property graph construction, feature extraction, hybrid contrastive learning, and causal reasoning to generate concise and accurate vulnerability explanations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If deep learning-based vulnerability detection methods are used, then detection accuracy is improved, but the black-box nature reduces model robustness and explainability
Solution Approach 1:
The patent introduces an explanation generation module as an intermediary between the black-box vulnerability detection model and the user. This module generates natural language explanations that reveal the model's reasoning process, making the black-box model's decisions interpretable without modifying the model's core detection functionality. The explanation module acts as a mediator that translates the model's internal representations into human-understandable justifications.
Solution Approach 2:
The system segments the vulnerability detection process into two independent components: the detection model itself and the explanation generation module. This segmentation allows the detection model to focus on accuracy while the explanation module handles robustness and interpretability, resolving the contradiction between detection performance and model transparency.
2Loss of information
If explanation methods are added to black-box models, then explainability is improved, but system complexity increases
Solution Approach 1:
The explanation generation module utilizes the internal representations and attention mechanisms already present in the transformer-based detection model to generate explanations. Rather than requiring external complex explanation systems, the model's own structural properties (self-attention weights, intermediate representations) are leveraged to produce interpretations, making the explanation process self-serving and reducing overall system complexity.
3Ease of manufacture
If perturbation mechanisms are used for explanation, then explanation generation is simplified, but weak model robustness leads to incorrect explanations
Solution Approach 1:
The patent replaces the mechanical perturbation-based explanation approach with a representation-based explanation mechanism. Instead of relying on input perturbations to infer model behavior, the system directly extracts explanations from the model's internal representations and attention mechanisms, substituting the perturbation mechanism with a more reliable interpretation of the model's actual decision-making process.
4Loss of information
If factual reasoning explanations are generated, then model predictions are explained, but explanations contain redundant statements reducing conciseness
Solution Approach 1:
The explanation generation module extracts only the most critical features and reasoning paths from the model's internal representations, rather than presenting all factual reasoning steps. By selectively extracting the most relevant information that contributes to the vulnerability detection decision, the system produces concise explanations that minimize manual audit time while maintaining explanatory power.
Data Source
AI summary
Disclosed in the present disclosure are an explainable vulnerability detection method and system based on dual-view causal reasoning. The vulnerability detection method includes: S1, obtaining code samples, where the code samples include a training sample and a sample to be detected, sequentially performing data augmentation, static analysis, code property graph construction and feature extraction on the training sample, and obtaining a training data set; and sequentially performing static analysis, code property graph construction and feature extraction on the sample to be detected, and obtaining a data set to be detect; S2, processing the training data set through a hybrid contrastive learning method, and establishing a vulnerability detection model; and inputting the data set to be detected into the vulnerability detection model, and outputting a vulnerability code; and S3, performing causal reasoning on the vulnerability code, and outputting a vulnerability detection explanation.