# Automated Vulnerability Detection in Source Code Using Minimum Intermediate Representation Learning
## 3 Preliminary  
### Motivating Examples  
Vulnerability is a defect or fault that can be exploited by a malicious user to make the software perform operations different from its design logic. From a source code perspective, most vulnerabilities are rooted in a critical operation that raises security issues. The critical operation can be a function, an assignment or a control statement. An attacker can directly or indirectly influence this critical operation by controlling certain variables or conditions.  
Buffer overflow vulnerability (CWE-119) is selected to illustrate the feature of vulnerability. This is because the buffer overflow vulnerability has become the most impacted vulnerability, according to a report from Common Weakness Enumeration in 2019 [35]. In addition, it is representative because of complex data dependence and control dependence. Although buffer overflow vulnerability is selected as an example, our method is universal for other types of vulnerability detection.  
Buffer overflow refers to the writing of data in the buffer that exceeds its own length, resulting in the overwriting of storage units outside the buffer. Figure 1 illustrates an intra-procedural buffer overflow vulnerability in file \"example_1.c.\" The variable \"buf\" is allocated a buffer of 10 bytes and assigned values through a \"for\" loop. When the loop reaches the eleventh times (i = 10), \"buf\" can still be assigned. This operation overflows the buffer of \"buf.\" In this sample, all the relevant codes for the vulnerability are inside the procedure \"main.\" The critical operation is an assignment in line 12. It is data-dependent on line 5 and control dependent on lines [4; 10]. The scope of this vulnerability is lines [4; 5; 10; 12]. In this example, the variable \"buf\" is declared on line 6 but assigned on line 13. This reflects the long-term dependence issue. In addition, lines {1, 2, 3, 6, 7, 8, 9, 11, 13, 14} are irrelevant statements. These factors will interfere with the learning of vulnerable programming patterns. In the real-world programs, the percentage of irrelated code may be high.  
Figure 2 illustrates an inter-procedural buffer overflow vulnerability in file \"example_2.c.\" In the function \"test,\" the variable \"buf\" is allocated a buffer of 64 bytes. However, it can be copied  
Figure 1: File “example_1.c” with an intra-procedural buffer overflow vulnerability.  
to 1024 bytes data at most in line 6. When the size of the variable \"str\" exceeds 64 bytes, it will overflow the buffer of \"buf\". The value of the variable \"str\" comes from the main function. This is an inter-procedural vulnerability whose critical operation is a data copy in line 6. The scope of this vulnerability is lines {12, 13, 15, 16, 17, 1, 3, 4, 6}.  
As can be seen from the above two examples, many instructions are irrelevant to a vulnerability. Therefore, detection with function-level or file-level granularity will be interfered with by the irrelevant instructions. The second example illustrates that vulnerability may span multiple functions. Therefore, a method with improper detection granularity fails to discover the inter-procedural vulnerabilities. In addition, function-level and file-level granularity is too coarse to assist the developer with an audit. A lot of human intervention is needed to pinpoint the vulnerabilities and make fixes.