ObliVul models safety obligations to reduce false alerts in code vulnerability detection
ObliVul: Alert-Conditioned Safety Obligation Modeling and Bidirectional Counterfactual Validation for Code Vulnerability Detection
Software Engineering
Summary
When software scanning tools warn about possible security problems in code, they often produce many alerts, most of which are false alarms. The authors propose ObliVul, a method that carefully analyzes each alert by understanding the safety rules the code must follow and checking how those rules relate to the alert. By doing this, ObliVul can better tell real issues from false ones, improving the accuracy of vulnerability detection. Their tests show that this approach reduces unnecessary warnings and correctly spots code fixes.
What this means in practice
- •For software security teams: Improve alert prioritization by reducing false positives in static vulnerability scanning during software development.
- •For software quality assurance teams: Enhance code review processes by providing clearer evidence linking alerts to safety rules and actual risks in code functions.
Authors
Heyang Tan, Chengxin Gao, Xin Wen, Jiaxin Li, Rui Cao
Abstract
In real-world software development, the primary challenge in vulnerability detection is often not finding suspicious code, but identifying which alerts among the large number of candidate alerts produced by static analysis truly warrant attention. Existing learning-based methods mainly identify suspicious patterns at the function or line level, making it difficult to extract complete program evidence centered on an individual alert. Although large language models can infer risk sources, dangerous operations, protection conditions, and state preconditions from local program facts, such semantic information cannot be reliably aligned with specific program nodes, dependency relations, and propagation paths, and is therefore insufficient to verify whether the corresponding safety obligations truly affect the current alert. To address this problem, we propose ObliVul, an alert-conditioned safety obligation modeling and bidirectional counterfactual validation framework for vulnerability detection. For each candidate alert, ObliVul first extracts a Local Evidence Pack (LEP) from the Code Property Graph (CPG) and uses a large language model to recover candidate safety obligations. It then aligns the safety obligations with program nodes, dependency edges, and path scopes to construct a Local Safety Obligation Graph (LSOG). Finally, VAFI aggregates complementary verified alert evidence while suppressing redundant or weaker evidence to produce a function-level vulnerability prediction. Experimental results show that ObliVul effectively distinguishes vulnerable versions from fixed versions and reduces persistent false positives on fixed code. Ablation studies further confirm the necessity of each component for safety obligation recovery, risk response validation, and function-level vulnerability inference.