Abstract: Automated source code vulnerability detection is crucial for ensuring software security.Currently,deep learning-based vulnerability detection models predominantly rely on supervised learning,which requires a substantial number of credible,labeled vulnerability samples for training.However,the collection of such samples is costly and dependent on expert knowledge.More-over,real-world applications often face challenges such as class imbalance.To address these challenges,this paper proposes DLP-VulD,a novel semi-supervised model that introduces a dual-stage label propagation method to the field of source code vulnerability detection for the first time.Firstly,it extracts program slices containing vulnerability context from source code using code property graphs(CPG) and learns their semantic and structural features with a BiLSTM model to generate code feature vectors.Subsequently,DLP-VulD employs the dual-stage label propagation mechanism to extend the training set by propagating trusted label information from labeled to unlabeled samples.In the first stage of label propagation,leveraging an initial small set of labeled samples,DLP-VulD calculates label influence to select high-credible pseudo-labeled(HCP) samples and partial-labeled(PAL) samples(those with multiple candidate labels) from the unlabeled set.In the second stage,to mitigate label propagation noise,a multi-source partial label learning(MSPLL) method is proposed to perform label disambiguation for the PAL samples.Finally,in the vulnerability detection module,DLP-VulD utilizes the original labeled samples,the HCP samples,and the disambiguated PAL samples to form an augmented dataset for reinforced training,thereby enhancing the classifier’s detection performance.Additionally,DLP-VulD adopts a class-weighting mechanism to reduce the impact of class imbalance.Comparative experiments on multiple real-world open-source project datasets and synthetic vulnerability datasets demonstrate that DLP-VulD surpasses traditional supervised methods in overall performance,showing significant improvements in Recall and F1-score compared to baselines such as Devign,VulDeePecker,and LineVul.On six real-world vulnerability datasets characterized by class imbalance and diverse vulnerability types,DLP-VulD achieves an average reduction of 8% in false positive rate(FPR) and 29.6% in false negative rate(FNR) compared to the baselines.Even with a very limited labeled set(10%),DLP-VulD effectively balances its detection capability for true vulnerabilities with control over false positives,achieving superior comprehensive performance.Experimental results confirm the effectiveness of DLP-VulD for training and deploying vulnerability detection models in environments with scarce labeled data.

Key words: Vulnerability detection, Label influence, Multi-source partial label learning, Class weighting, Semi-supervised learning