Data Quality for Software Vulnerability Datasets

Abstract

The use of learning-based techniques to achieve automated software vulnerability detection has been of longstanding interest within the software security domain. These data-driven solutions are enabled by large software vulnerability datasets used for training and benchmarking. However, we observe that the quality of the data powering these solutions is currently ill-considered, hindering the reliability and value of produced outcomes. Whilst awareness of software vulnerability data preparation challenges is growing, there has been little investigation into the potential negative impacts of software vulnerability data quality. For instance, we lack confirmation that vulnerability labels are correct or consistent. Our study seeks to address such shortcomings by inspecting five inherent data quality attributes for four state-of-the-art software vulnerability datasets and the subsequent impacts that issues can have on software vulnerability prediction models. Surprisingly, we found that all the analyzed datasets exhibit some data quality problems.In particular, we found 20-71% of vulnerability labels to be inaccurate in real-world datasets, and 17-99% of data points were duplicated. We observed that these issues could cause significant impacts on downstream models, either preventing effective model training or inflating benchmark performance. We advocate for the need to overcome such challenges. Our findings will enable better consideration and assessment of software vulnerability data quality in the future.

Toward Improved Deep Learning-based Vulnerability Detection

“…We have also noticed this in our own experiments. Because of this, the quality of the data included in vulnerability datasets has been the subject of previous research [16]. Security data quality transcends vulnerability detection: security bug report prediction has also gained traction and data quality matters for this type of insight too [39,41].…”

On Evaluation of Document Classification with RVL-CDIP

“…Orthogonal to label errors, prior work has also observed non-trivial overlap between test and train splits in datasets on which natural language processing and computer vision models are evaluated (e.g., Finegan-Dollak et al, 2018;Allamanis, 2019;Barz and Denzler, 2020;Lewis et al, 2021;Wen et al, 2022;Croft et al, 2023). Such work often argues that non-trivial amounts of overlap between test and train data can lead to "inflated" performance scores, as overlapping data can reward a model's ability to memorize training data (Elangovan et al, 2021), and to under-estimate out-of-sample error (Søgaard et al, 2021).…”