🤖 AI Summary
This work addresses the limitations of existing vulnerability detection benchmarks, which are predominantly confined to the function level and thus fail to capture cross-procedural vulnerabilities prevalent in real-world scenarios, while manually curated repository-scale datasets suffer from limited scalability. To overcome these challenges, the paper proposes an automated benchmark generation framework that injects realistic vulnerabilities into genuine code repositories and synthesizes reproducible proofs of vulnerability (PoVs), thereby constructing a large-scale, precisely labeled repository-level vulnerability dataset. This framework represents the first scalable approach to automatically generating repository-level vulnerability benchmarks. Furthermore, it introduces an adversarial co-evolution mechanism, enabling dynamic interaction between vulnerability injection and detection agents under realistic constraints, which significantly enhances the robustness and practical utility of vulnerability detection models.
📝 Abstract
Software vulnerabilities continue to grow in volume and remain difficult to detect in practice. Although learning-based vulnerability detection has progressed, existing benchmarks are largely function-centric and fail to capture realistic, executable, interprocedural settings. Recent repo-level security benchmarks demonstrate the importance of realistic environments, but their manual curation limits scale. This doctoral research proposes an automated benchmark generator that injects realistic vulnerabilities into real-world repositories and synthesizes reproducible proof-of-vulnerability (PoV) exploits, enabling precisely labeled datasets for training and evaluating repo-level vulnerability detection agents. We further investigate an adversarial co-evolution loop between injection and detection agents to improve robustness under realistic constraints.