Introduction
This research investigates the trade-offs between cost and effectiveness in vulnerability mining for C programs. To do this, the study first encodes functions using CodeBERT. It then applies four clustering methods—K-means, hierarchical clustering, Gaussian Mixture Model (GMM), and ALGG—to group the functions. The optimal number of clusters is determined using internal clustering metrics (such as the silhouette coefficient) and a cluster number selection algorithm. The approach is validated on the POJ-104 dataset, and its external metrics are analyzed.Next, the study empirically evaluates the cost-effectiveness trade-offs. Experiments are conducted on eight target programs. Eight state-of-the-art grey-box fuzzing tools are used, with each tool undergoing 20 repeated test runs (for a total of 1,280 fuzzing campaigns). Each run lasts for 24 hours.
Contribution🎉
We propose a novel relationship between vulnerabilities and code clustering, demonstrating that vulnerabilities tend to concentrate in specific function clusters. Our verification of this non-uniform distribution proves that comprehensive testing of all functions is unnecessary for effective vulnerability detection
We design an innovative Multi-Objective Optimal Clustering Number Selection algorithm to automatically determine the optimal number of function clusters, addressing a critical challenge in code analysis.
Through extensive experiments, we show that our proposed termination criterion significantly outperforms existing methods in terms of computational efficiency while maintaining detection accuracy
We open-source all relevant code and datasets to support reproducibility and encourage further research advancement in the community.