One-for-All Does Not Work! Enhancing Vulnerability Detection by Mixture-of-Experts (MoE)
Deep Learning-based Vulnerability Detection (DLVD) techniques have garnered significant interest due to their ability to automatically learn vulnerability patterns from previously compromised code. Despite the notable accuracy demonstrated by pioneering tools, the broader application of DLVD methods in real-world scenarios is hindered by significant challenges. A primary issue is the “one-for-all” design, where a single model is trained to handle all types of vulnerabilities. This approach fails to capture the patterns of different vulnerability types, resulting in suboptimal performance, particularly for less common vulnerabilities that are often underrepresented in training datasets. To address these challenges, we propose MoEVD, which adopts the Mixture-of-Experts (MoE) framework for vulnerability detection. MoEVD decomposes vulnerability detection into two tasks, CWE type classification and CWE-specific vulnerability detection. By splitting the task, in vulnerability detection, MoEVD allows specific experts to handle distinct types of vulnerabilities instead of handling all vulnerabilities within one model. Our results show that MoEVD achieves an F1-score of 0.44, significantly outperforming all studied state-of-the-art (SOTA) baselines by at least 12.8%. MoEVD excels across almost all CWE types, improving recall over the best SOTA baseline by 9% to 77.8%. Notably, MoEVD does not sacrifice performance on long-tailed CWE types; instead, its MoE design enhances performance (F1-score) on these by at least 7.3%, addressing long-tailed issues effectively.
Tue 24 JunDisplayed time zone: Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna change
10:30 - 12:30 | Vulnerability 2Research Papers / Demonstrations at Pirsenteret 150 Chair(s): Xiaoxue Ren Zhejiang University | ||
10:30 20mTalk | Statement-level Adversarial Attack on Vulnerability Detection Models via Out-Of-Distribution Features Research Papers Xiaohu Du Huazhong University of Science and Technology, Ming Wen Huazhong University of Science and Technology, Haoyu Wang , Zichao Wei Huazhong University of Science and Technology, Hai Jin Huazhong University of Science and Technology DOI | ||
10:50 20mTalk | Large Language Models for In-File Vulnerability Localization can be “Lost in the End” Research Papers Francesco Sovrano Collegium Helveticum, ETH Zurich, Switzerland; Department of Informatics, University of Zurich, Switzerland, Adam Bauer University of Zurich, Alberto Bacchelli University of Zurich DOI | ||
11:10 20mTalk | One-for-All Does Not Work! Enhancing Vulnerability Detection by Mixture-of-Experts (MoE) Research Papers Xu Yang University of Manitoba, Shaowei Wang University of Manitoba, Jiayuan Zhou Huawei, Wenhan Zhu Huawei Canada DOI | ||
11:30 20mTalk | Gleipner: A Benchmark for Gadget Chain Detection in Java Deserialization Vulnerabilities Research Papers DOI | ||
11:50 10mTalk | BinPool: A Dataset of Vulnerabilities for Binary Security Analysis Demonstrations Sima Arasteh University of Southern California, Georgios Nikitopoulos Dartmouth College, University of Thessaly, Wei-Cheng Wu Dartmouth College, Nicolaas Weideman USC Information Sciences Institute, Aaron Portnoy Dartmouth College, Mukund Raghothaman University of Southern California, Christophe Hauser Dartmouth College | ||
12:00 20mTalk | Today's cat is tomorrow's dog: accounting for time-based changes in the labels of ML vulnerability detection approaches Research Papers Ranindya Paramitha University of Trento, Yuan Feng , Fabio Massacci University of Trento; Vrije Universiteit Amsterdam DOI Pre-print | ||
12:20 10mTalk | KAVe: A Tool to Detect XSS and SQLi Vulnerabilities using a Multi-Agent System over a Multi-Layer Knowledge Graph Demonstrations Rafael Ramires LASIGE, DI, Faculdade de Ciencias da Universidade de Lisboa, Ana Respício LASIGE, DI, Faculdade de Ciencias da Universidade de Lisboa, Ibéria Medeiros LaSIGE, Faculdade de Ciências da Universidade de Lisboa, Mike Papadakis University of Luxembourg |
This room is located outside Clarion Hotel
This room is located in the Pirsenteret (The Pier Center) convention center. It is just outside the hotel, on the back, towards the fjord.
You should be able to go through the emergency exit at Clarion, just on the side of the Cosmos 3 wing, which will be bring you close to Pirsenteret.
The entrance to the center is from here:
https://maps.app.goo.gl/dU3qH6kAimXGBNHe7
Once inside, go all straight and you will find signage to reach the room. The room is known as room 150 inside the center.