Abstract: Compared to traditional methods,AI-based vulnerability detection reduces reliance on expert knowledge and improves detection efficiency.However,training these models typically requires many labeled samples,which are difficult to obtain in practice.Therefore,effectively utilizing large volumes of unlabeled code samples to enhance model performance under limited labeled data has become a critical issue in automatic software vulnerability detection.Positive-Unlabeled(PU) Learning,a semi-supervised approach,combines a small set of positive samples with a large number of unlabeled samples to train models like random forests.By assigning class scores to unlabeled samples,PU Learning generates pseudo-labeled data,improving training performance.However,PU Learning may generate incorrect labels when sample scores are close to the threshold.This paper proposes an integrated PU Learning method(PUEVD),to achieve semi-supervised vulnerability detection in source code.PUEVD first calculates class scores of unlabeled samples using a random forest,filters key features,and randomly selects feature subsets.For each subset,it calculates the similarity difference between misclassification-prone samples and reliable positive/negative samples.Based on ensemble learning,PUEVD aggregates these similarity differences across subsets to adjust and optimize class scores,reducing the risk of misclassification.Applied to vulnerability detection with limited labeled samples,PUEVD was validated on standard datasets,including CWE399,libtiff,and asterisk,showing improved AUC and F1 scores over traditional methods,thus demonstrating its effectiveness in vulnerability detection.

Key words: PU learning, Vulnerability detection, Ensemble learning, Scores-adjustment, Semi-supervised learning