Automated code vulnerability detection has gained increasing attention in recent years. The deep learning (DL)-based methods, which implicitly learn vulnerable code patterns, have proven effective in vulnerability detection. The performance of DL-based methods usually relies on the quantity and quality of labeled data. However, the current labeled data are generally automatically collected, such as crawled from human-generated commits, making it hard to ensure the quality of the labels. Prior studies have demonstrated that the non-vulnerable code (i.e., negative labels) tends to be unreliable in commonly-used datasets, while vulnerable code (i.e., positive labels) is more determined. Considering the large numbers of unlabeled data in practice, it is necessary and worth exploring to leverage the positive data and large numbers of unlabeled data for more accurate vulnerability detection. In this paper, we focus on the Positive and Unlabeled (PU) learning problem for vulnerability detection and propose a novel model named PILOT, i.e., PositIve and unlabeled Learning mOdel for vulnerability deTection. PILOT only learns from positive and unlabeled data for vulnerability detection. It mainly contains two modules: (1) A distance-aware label selection module, aiming at generating pseudo-labels for selected unlabeled data, which involves the inter-class distance prototype and progressive fine-tuning; (2) A mixed-supervision representation learning module to further alleviate the influence of noise and enhance the discrimination of representations.

翻译：自动化代码漏洞检测近年来受到越来越多关注。基于深度学习的方法通过隐式学习脆弱代码模式，已被证明在漏洞检测中有效。此类方法的性能通常依赖标注数据的数量和质量。然而，当前标注数据通常自动采集（例如从人工编写的提交记录中抓取），难以确保标签质量。先前研究表明，常用数据集中非脆弱代码（即负标签）往往不可靠，而脆弱代码（即正标签）则更确定。考虑到实践中存在大量无标签数据，利用正样本与无标签数据提升漏洞检测准确性具有必要性和探索价值。本文聚焦漏洞检测中的正样本与无标签学习问题，提出新型模型PILOT（PositIve and unlabeled Learning mOdel for vulnerability deTection）。该模型仅通过正样本与无标签数据进行漏洞检测，主要包含两个模块：（1）距离感知标签选择模块，通过类间距离原型与渐进微调为选定无标签数据生成伪标签；（2）混合监督表征学习模块，进一步降低噪声影响并增强表征判别性。