Vulnerability detection improves with structured code behavior explanations
Structured Security Explanations for Learning-Based Vulnerability Detection
Cryptography and SecuritySoftware Engineering
Summary
Detecting security problems in software is hard because current tools either rely on fixed rules or try to learn patterns from large code samples without clear reasoning. The authors developed VulnLens, which first explains what a piece of code does in a structured way, then uses that explanation to help detect vulnerabilities. This approach works better than previous methods, particularly when tested on different sets of code without retraining. It shows that clear descriptions of code behavior can boost accuracy in spotting security issues.
What this means in practice
- •For software security teams: Enhance automated vulnerability scanning by integrating structured behavioral explanations to improve detection accuracy across diverse C/C++ codebases.
- •For application developers: Identify potential security flaws earlier by adopting tools that combine code analysis with explainable program behavior insights for safer software releases.
- •For cybersecurity product firms: Build advanced vulnerability detection products that offer explainable reasoning behind findings, increasing client trust and detection reliability.$Commercial implications: Enables creation of security scanning products with deeper explanations appealing to enterprise customers seeking transparency.
Authors
Fares Trad, Yizhou Chen, Hung Viet Pham, Zeyu Sun, Gias Uddin
Abstract
Software vulnerability detection remains difficult because existing approaches rely on predefined analysis rules, learn vulnerability patterns implicitly from code and labels, or use large language models (LLMs) to make the final security judgment. It remains unclear whether structured descriptions of security-relevant program behavior can improve supervised detection. We present VulnLens, an explanation-augmented framework for binary C/C++ vulnerability detection that separates program-behavior analysis from the final decision. A label-blind LLM-based Explainer examines each function from seven fixed perspectives: data flow, memory access, object lifetime, arithmetic and type behavior, control flow, shared state, and external-resource access. Without receiving vulnerability labels or CWE information, it generates structured explanations. A supervised Detector combines source code and explanations through sequential cross-attention. We evaluate VulnLens on a PrimeVul-derived dataset covering ten CWE categories and test transfer to SecVulEval without retraining. On the 526-function PrimeVul test set, VulnLens achieves 75.5% accuracy and 77.2% F1, exceeding DeepSeek V4 Pro by 4.2 percentage points in accuracy and Gemini 2.5 Pro by 2.2 points in F1. Matched explanations improve F1 by 7.3 points over a separately trained code-only detector. On SecVulEval, VulnLens achieves 66.4% accuracy and 65.8% F1, outperforming DeepSeek V4 Pro by 7.6 points in accuracy and 20.0 points in F1, and Gemini 2.5 Pro by 16.6 points in accuracy and 7.8 points in F1.