VDExplainer: Sequential decision-making and probability sampling guided statement-level explanation for vulnerability detection

Most existing deep learning (DL) based vulnerability detection methods, including pre-trained models, are coarse-grained binary classification methods that lack the interpretability for detection results. Although the explanation of deep learning has received significant attention, there is little research on the explanation of pre-trained model-based vulnerability detection methods. Therefore, we focus on providing statement-level interpretability for these vulnerability detection models to help developers understand the vulnerabilities. More specifically, given a vulnerable code detected by the model, our task is to find the set of vulnerability-related statements that lead to the prediction. Inspired by the manual code review process, this paper proposes a framework for explaining vulnerability detection called VDExplainer. VDExplainer includes an explorer that uses sequential decision-making and probability sampling to find the combination of vulnerability-related statements and a navigator that helps reduce the search space by learning the vulnerability patterns. It is worth noting that the navigator is trained in advance and then integrated with the explorer, further enhancing the efficiency and effectiveness of VDExplainer. Extensive experiments on the semi-synthetic dataset and the widely used real-world project dataset show that VDExplainer achieves superior performance, outperforming current state-of-the-art methods.