Towards the Use of Domain Knowledge to Enhance Transformer-Based Vulnerability Detection

In the last years, several software vulnerability detection techniques based on learning methods, such as deep-learning and large language models, have been proposed to detect vulnerabilities in source code. These techniques build code classification models from datasets of code snippets labeled as vulnerable and non-vulnerable, with the purpose of predicting the presence of vulnerabilities in new code snippets. Experiments documented in the literature, however, show that such techniques can achieve promising results only under specific context and conditions. In this paper, we document a preliminary investigation on the impact of the use of domain-specific knowledge information on vulnerability detection tasks. To this aim, a transformer-based vulnerability detection method has been enhanced with domain-specific knowledge information and an experiment has been performed to understand whether such additional domain knowledge information can increase the detection performance of the learning-based method.