Vul2image: A quick image-inspired and CNN-based vulnerability detection system

Abstract

Given the accuracy of deep learning (DL) in image classification, some studies have applied DL algorithms to vulnerability detection by characterizing software source code as RGB images. However, effectively utilizing RGB images to store multiple code semantics remains a challenge, impacting the effectiveness of vulnerability detection. To address this, we developed Vul2image, a quick Image-inspired and CNN-based Vulnerability Detection System. By focusing on Potential Vulnerable Code Fragments (PVCFs) and their context code, Vul2image minimized interference from irrelevant information and achieved comprehensive coverage of vulnerability features. It constructed an RGB fine-grained image model incorporating textual, semantic, and structural information from code text, Control Dependency Graphs (CDGs), and Data Dependency Graphs (DDGs), resulting in improved detection efficiency. Evaluated on three datasets with increasing vulnerability types (including our self-collected, VulCNN, and Devign), Vul2image achieved the best results on our dataset, outperforming 9 classic (incl. 4 LLM-based) and 2 SOTA image-based detectors (VulCNN, VulGAI) and demonstrating performance comparable to 7 transformer-encoder-based methods, showing strong precision for specific vulnerability types. In practice, Vul2image was 35 times faster than VulCNN and successfully identified 21 reported and 5 unreported vulnerabilities in various real-world systems and software within 67,352,085 lines of code, showcasing its large-scale vulnerability detection capability.