VULOC: Vulnerability location framework based on assembly code slicing

Abstract

Automated detection of software vulnerabilities is an important topic in software security. Although the currently proposed deep learning-based approaches are effective in detecting vulnerabilities, their lack of accuracy in pinpointing the location of vulnerabilities leads to significant limitations in real-world usage. To address the above problem, we propose a vulnerability location framework based on assembly code slicing, VULOC, which achieves high detection capability and localization accuracy. VULOC first compiles C/C++ programs to obtain assembly code containing addresses. Then we use Addr2line to generate the mapping between assembly code and source code line numbers, and slice the assembly code into code blocks, which are encoded into the neural network model. Finally, we propose the BLSTM-LOC model for learning vulnerability features and predicting vulnerability locations. To the best of our knowledge, it is the first time that the mapping relationship between assembly code and source code line numbers is exploited for vulnerability detection. Experimental results show that VULOC exhibits higher performance than the current state-of-the-art vulnerability detection methods, both on existing datasets and real-world software products in vulnerability detection.