{"id":"https://openalex.org/W4400351643","doi":"https://doi.org/10.1109/tse.2024.3423712","title":"Revisiting the Performance of Deep Learning-Based Vulnerability Detection on Realistic Datasets","display_name":"Revisiting the Performance of Deep Learning-Based Vulnerability Detection on Realistic Datasets","publication_year":2024,"publication_date":"2024-07-05","ids":{"openalex":"https://openalex.org/W4400351643","doi":"https://doi.org/10.1109/tse.2024.3423712"},"language":"en","primary_location":{"id":"doi:10.1109/tse.2024.3423712","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tse.2024.3423712","pdf_url":null,"source":{"id":"https://openalex.org/S8351582","display_name":"IEEE Transactions on Software Engineering","issn_l":"0098-5589","issn":["0098-5589","1939-3520","2326-3881"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Software Engineering","raw_type":"journal-article"},"type":"article","indexed_in":["arxiv","crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2407.03093","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5048882099","display_name":"Partha Chakraborty","orcid":"https://orcid.org/0000-0001-5965-615X"},"institutions":[{"id":"https://openalex.org/I151746483","display_name":"University of Waterloo","ror":"https://ror.org/01aff2v68","country_code":"CA","type":"education","lineage":["https://openalex.org/I151746483"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Partha Chakraborty","raw_affiliation_strings":["David R. Cheriton School of Computer Science, University of Waterloo, Waterloo, ON, Canada"],"raw_orcid":"https://orcid.org/0000-0001-5965-615X","affiliations":[{"raw_affiliation_string":"David R. Cheriton School of Computer Science, University of Waterloo, Waterloo, ON, Canada","institution_ids":["https://openalex.org/I151746483"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5111249844","display_name":"Krishna Kanth Arumugam","orcid":null},"institutions":[{"id":"https://openalex.org/I151746483","display_name":"University of Waterloo","ror":"https://ror.org/01aff2v68","country_code":"CA","type":"education","lineage":["https://openalex.org/I151746483"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Krishna Kanth Arumugam","raw_affiliation_strings":["David R. Cheriton School of Computer Science, University of Waterloo, Waterloo, ON, Canada"],"raw_orcid":"https://orcid.org/0009-0000-2309-0203","affiliations":[{"raw_affiliation_string":"David R. Cheriton School of Computer Science, University of Waterloo, Waterloo, ON, Canada","institution_ids":["https://openalex.org/I151746483"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5091616761","display_name":"Mahmoud Alfadel","orcid":"https://orcid.org/0000-0002-2621-6104"},"institutions":[{"id":"https://openalex.org/I151746483","display_name":"University of Waterloo","ror":"https://ror.org/01aff2v68","country_code":"CA","type":"education","lineage":["https://openalex.org/I151746483"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Mahmoud Alfadel","raw_affiliation_strings":["David R. Cheriton School of Computer Science, University of Waterloo, Waterloo, ON, Canada"],"raw_orcid":"https://orcid.org/0000-0002-2621-6104","affiliations":[{"raw_affiliation_string":"David R. Cheriton School of Computer Science, University of Waterloo, Waterloo, ON, Canada","institution_ids":["https://openalex.org/I151746483"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5029916309","display_name":"Meiyappan Nagappan","orcid":"https://orcid.org/0000-0003-4533-4728"},"institutions":[{"id":"https://openalex.org/I151746483","display_name":"University of Waterloo","ror":"https://ror.org/01aff2v68","country_code":"CA","type":"education","lineage":["https://openalex.org/I151746483"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Meiyappan Nagappan","raw_affiliation_strings":["David R. Cheriton School of Computer Science, University of Waterloo, Waterloo, ON, Canada"],"raw_orcid":"https://orcid.org/0000-0003-4533-4728","affiliations":[{"raw_affiliation_string":"David R. Cheriton School of Computer Science, University of Waterloo, Waterloo, ON, Canada","institution_ids":["https://openalex.org/I151746483"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5043053174","display_name":"Shane McIntosh","orcid":"https://orcid.org/0000-0002-0193-3975"},"institutions":[{"id":"https://openalex.org/I151746483","display_name":"University of Waterloo","ror":"https://ror.org/01aff2v68","country_code":"CA","type":"education","lineage":["https://openalex.org/I151746483"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Shane McIntosh","raw_affiliation_strings":["David R. Cheriton School of Computer Science, University of Waterloo, Waterloo, ON, Canada"],"raw_orcid":"https://orcid.org/0000-0002-0193-3975","affiliations":[{"raw_affiliation_string":"David R. Cheriton School of Computer Science, University of Waterloo, Waterloo, ON, Canada","institution_ids":["https://openalex.org/I151746483"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I151746483"],"apc_list":null,"apc_paid":null,"fwci":4.1381,"has_fulltext":false,"cited_by_count":19,"citation_normalized_percentile":{"value":0.94417624,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":99,"max":100},"biblio":{"volume":"50","issue":"8","first_page":"2163","last_page":"2177"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9972000122070312,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9972000122070312,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9962000250816345,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9944999814033508,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8655103445053101},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.5439034700393677},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.4462237060070038},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.4360957145690918},{"id":"https://openalex.org/keywords/data-science","display_name":"Data science","score":0.4016181528568268},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.3849645256996155},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.2724063992500305}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8655103445053101},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.5439034700393677},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4462237060070038},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.4360957145690918},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.4016181528568268},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3849645256996155},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.2724063992500305}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1109/tse.2024.3423712","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tse.2024.3423712","pdf_url":null,"source":{"id":"https://openalex.org/S8351582","display_name":"IEEE Transactions on Software Engineering","issn_l":"0098-5589","issn":["0098-5589","1939-3520","2326-3881"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Software Engineering","raw_type":"journal-article"},{"id":"pmh:oai:arXiv.org:2407.03093","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2407.03093","pdf_url":"https://arxiv.org/pdf/2407.03093","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"pmh:oai:zenodo.org:12707476","is_oa":true,"landing_page_url":"https://doi.org/10.1109/TSE.2024.3423712","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Transactions on Software Engineering, 1-15, (2024-07-05)","raw_type":"info:eu-repo/semantics/article"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2407.03093","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2407.03093","pdf_url":"https://arxiv.org/pdf/2407.03093","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[{"display_name":"Reduced inequalities","id":"https://metadata.un.org/sdg/10","score":0.47999998927116394}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":60,"referenced_works":["https://openalex.org/W107619411","https://openalex.org/W1924770834","https://openalex.org/W1970092758","https://openalex.org/W2003233718","https://openalex.org/W2008056655","https://openalex.org/W2064675550","https://openalex.org/W2079753286","https://openalex.org/W2088252378","https://openalex.org/W2148143831","https://openalex.org/W2187089797","https://openalex.org/W2295598076","https://openalex.org/W2516809705","https://openalex.org/W2743316948","https://openalex.org/W2773223713","https://openalex.org/W2781491433","https://openalex.org/W2885030880","https://openalex.org/W2899379687","https://openalex.org/W2911964244","https://openalex.org/W2962960733","https://openalex.org/W2964015378","https://openalex.org/W2982577744","https://openalex.org/W3029879311","https://openalex.org/W3033393716","https://openalex.org/W3033777149","https://openalex.org/W3091588759","https://openalex.org/W3098605233","https://openalex.org/W3101228802","https://openalex.org/W3105037104","https://openalex.org/W3126121388","https://openalex.org/W3161071537","https://openalex.org/W3163206498","https://openalex.org/W3166095789","https://openalex.org/W3177116043","https://openalex.org/W3181414820","https://openalex.org/W3194346579","https://openalex.org/W4214525227","https://openalex.org/W4226148503","https://openalex.org/W4281763794","https://openalex.org/W4284710241","https://openalex.org/W4312436517","https://openalex.org/W4378509449","https://openalex.org/W4384918448","https://openalex.org/W4385570534","https://openalex.org/W4386185625","https://openalex.org/W4393300436","https://openalex.org/W4402040489","https://openalex.org/W6630256684","https://openalex.org/W6632100814","https://openalex.org/W6640212811","https://openalex.org/W6676769703","https://openalex.org/W6726873649","https://openalex.org/W6756192570","https://openalex.org/W6767260250","https://openalex.org/W6804000844","https://openalex.org/W6852457518","https://openalex.org/W6853251322","https://openalex.org/W6854866820","https://openalex.org/W6860710830","https://openalex.org/W6863309691","https://openalex.org/W7054444732"],"related_works":["https://openalex.org/W2731899572","https://openalex.org/W2961085424","https://openalex.org/W3215138031","https://openalex.org/W4306674287","https://openalex.org/W3009238340","https://openalex.org/W4321369474","https://openalex.org/W4360585206","https://openalex.org/W4285208911","https://openalex.org/W3046775127","https://openalex.org/W3082895349"],"abstract_inverted_index":{"The":[0],"impact":[1],"of":[2,30,37,162,293],"software":[3,7],"vulnerabilities":[4,194,206],"on":[5,53,173],"everyday":[6],"systems":[8],"is":[9,234],"concerning.":[10],"Although":[11],"deep":[12,230,314],"learning-based":[13,231,315],"models":[14,32,45,135,185,246,316],"have":[15],"been":[16],"proposed":[17],"for":[18,80,136,236],"vulnerability":[19,82,92,143,174,177,232],"detection,":[20],"their":[21],"reliability":[22],"remains":[23],"a":[24,68,97,126,154,257,282,300,321],"significant":[25,99],"concern.":[26],"While":[27],"prior":[28],"evaluation":[29],"such":[31,153],"reports":[33],"impressive":[34],"recall/F1":[35],"scores":[36,114,192],"up":[38,107,117,272],"to":[39,75,108,118,197,209,226,273,280,289,305,318],"99%,":[40],"we":[41,66,151,166],"find":[42],"that":[43,223,284,303,312],"these":[44],"underperform":[46,247],"in":[47,101,129,157,169,238,248,320],"practical":[48,239],"scenarios,":[49],"particularly":[50],"when":[51,193,205],"evaluated":[52],"the":[54,60,130,134,158,183,219,291,313],"entire":[55],"codebases":[56],"rather":[57,203],"than":[58,204],"only":[59],"fixing":[61],"commit.":[62],"In":[63],"this":[64,262,306],"paper,":[65],"introduce":[67],"comprehensive":[69,301],"dataset":[70,283,302],"(<italic":[71],"xmlns:mml=\"http://www.w3.org/1998/Math/MathML\"":[72,298],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">Real-Vul</i>)":[73],"designed":[74],"accurately":[76],"represent":[77],"real-world":[78,322],"scenarios":[79],"evaluating":[81],"detection":[83,93,233],"models.":[84],"We":[85,241,260,275],"evaluate":[86],"DeepWukong,":[87],"LineVul,":[88],"ReVeal,":[89],"and":[90,95,112,138,160,179,251,308],"IVDetect":[91],"approaches":[94],"observe":[96,152,167],"surprisingly":[98],"drop":[100],"performance,":[102],"with":[103],"precision":[104],"declining":[105],"by":[106,116,133,263,271],"95":[109],"percentage":[110,120,188],"points":[111,189],"F1":[113,191],"dropping":[115],"91":[119],"points.":[121],"A":[122],"closer":[123],"inspection":[124],"reveals":[125],"substantial":[127,220],"overlap":[128],"embeddings":[131],"generated":[132],"vulnerable":[137],"uncertain":[139],"samples":[140],"(non-vulnerable":[141],"or":[142,200,212],"not":[144],"reported":[145],"yet),":[146],"which":[147],"likely":[148],"explains":[149],"why":[150,245],"large":[155],"increase":[156],"quantity":[159],"rate":[161],"false":[163],"positives.":[164],"Additionally,":[165],"fluctuations":[168],"model":[170,294],"performance":[171,221,270],"based":[172],"characteristics":[175],"(e.g.,":[176],"types":[178],"severity).":[180],"For":[181],"example,":[182],"studied":[184],"achieve":[186],"26":[187],"better":[190],"are":[195,207],"related":[196,208],"information":[198],"leaks":[199],"code":[201],"injection":[202],"path":[210],"resolution":[211],"predictable":[213],"return":[214],"values.":[215],"Our":[216],"results":[217],"highlight":[218],"gap":[222],"still":[224],"needs":[225],"be":[227],"bridged":[228],"before":[229],"ready":[235],"deployment":[237],"settings.":[240],"dive":[242],"deeper":[243],"into":[244],"realistic":[249],"settings":[250],"our":[252],"investigation":[253],"revealed":[254],"overfitting":[255],"as":[256],"key":[258],"issue.":[259],"address":[261],"introducing":[264],"an":[265,278],"augmentation":[266],"technique,":[267],"potentially":[268],"improving":[269],"30%.":[274],"contribute":[276],"(a)":[277],"approach":[279],"creating":[281],"future":[285],"research":[286],"can":[287],"use":[288],"improve":[290],"practicality":[292],"evaluation;":[295],"(b)":[296],"<italic":[297],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">Real-Vul</i>\u2013":[299],"adheres":[304],"approach;":[307],"(c)":[309],"empirical":[310],"evidence":[311],"struggle":[317],"perform":[319],"setting.":[323]},"counts_by_year":[{"year":2026,"cited_by_count":8},{"year":2025,"cited_by_count":11}],"updated_date":"2026-07-18T07:39:51.176621","created_date":"2024-07-06T00:00:00"}