# Automated Vulnerability Detection in Source Code Using Minimum Intermediate Representation Learning
## 4 Proposed Approach
### Pre-Processing  
A fine-granularity detection method can not only eliminate extraneous features in the analysis process but also provide detailed information to audit. Different from file-level and function-level granularity in many papers, our method chooses the subset of code related to vulnerabilities as detection granularity. We define minimum intermediate representation (MIR) as a sequence of tokens which are serialized from an inter-procedural program slice that takes a security-critical operation as a criterion. The order between tokens represents dependencies.  
As shown in Figure 4, the samples in the form of the source code are converted to minimum intermediate representations by static analysis in the pre-processing stage. First samples in the form of source code are converted into program dependency graphs by control dependency and data dependency analysis.  
Control dependency between statement \(i\) and statement \(j\) satisfies that \(\exists path:[i,j]\), (1) \(j\) post-dominate \(k\), \(k\in(i,\ j)\); (2) \(i\) is not post-dominate by \(j\).  
Data dependency between statement \(i\) and statement \(j\) satisfies that \(\exists x\in V\), (1) \(x\in DEF[i]\) and \(x\in USE[j]\); (2) \(\forall k\in(i,j)\), \(x\
ot\in DEF[k]\). \(V\) denotes the set of variables in a program. \(DEF[i]\) denotes the set of variables defined at statement \(i\), and \(USE[j]\) denote the set of variables referenced at statement \(j\)  
Figure 4: Overview of the pre-training stage. The solid arrows denote data dependencies and dashed arrows denote control dependencies in the system dependency graph.  
Figure 3: Overview of the proposed intelligent vulnerability detection method.  
In this paper, a program dependence graph (PDG) is a directed graph \(G=<S,E>\). \(S\) is the set of the vertex in the program dependency graph that denotes the statements. The E is the set of edges that represents the control dependency and data dependency. Given many vulnerabilities are inter-procedural, we generated the system dependence graph (SDG) by adding the invocation between procedures to the program dependency graph.  
Next, all the critical operations in the system dependency graph are located according to the characteristics of the vulnerability to be detected. A backward program slice is conducted on every critical operation. Then, we replace the call and declaration statements of the custom functions with a data dependency between the arguments to the parameters and a data dependency between the return values to the call points. We serialize the results of slicing in the order the code executes. So far, the basic unit is still a statement. Therefore, lexical analysis is performed to turn the slice into tokens. In the example shown in Figure 4, \"buf[i] = \"B\"\" is a critical operation for buffer overflow vulnerability. This is because its misuse can cause data to be written out of the buffer. The relevant statements are pinpointed by dependency analysis in the SDG. They are statements [\" for (int i = 0; i \(<=\) 10; i\(++\))\", \"char buff[10];\", \"int main()\"]. We serialize the critical operation and its associated statements in the executed order. Finally, by a custom lexical analysis, we obtain the MIR: [\"int\", \"main\", \"(\", \")\", \"[\", \"char\", \"buf\", \"[\", \"10\", \"]\", \", \"for\", \"(\", \"int\", \"i\", \"=\", \"0\", \", \"i\", \"<=\", \"10\", \", \"i\", \"++\", \")\", \"buf\", \"[\", \"i\", \"]\", \"=\", \", \", \"B\", \", \", \", \")\". As a result, the source code is transformed into a form similar to natural language.