VulInject: Multi-Type Samples Generation for Learning-based Vulnerability Detection

Deep learning-based source code vulnerability analysis has become a prominent trend in vulnerability detection, offering the capability to automatically extract vulnerability features and reduce manual effort. However, the limited availability of vulnerability data prevents models from comprehensively capturing diverse vulnerability patterns. In addition, the scarcity of samples labeled with specific vulnerability types restricts models to merely identifying the presence of vulnerabilities, without providing fine-grained type information that is crucial for efficient vulnerability diagnosis and remediation. To address these challenges, we propose VulInject, the first automated tool for generating multi-type vulnerable samples for learning-based detection. Our approach extracts edit patterns from existing vulnerability datasets and applies them to benign projects, thereby synthesizing realistic vulnerable code resembling real-world cases. Furthermore, we adopt a hybrid strategy that integrates static analysis with large language models to annotate the generated samples with precise vulnerability types. By augmenting existing datasets with these generated samples, we conduct extensive experiments on state-of-the-art binary and multi-class vulnerability detection models. Results demonstrate substantial performance gains, with binary classification models achieving up to a 13.50% increase in F1 score, and multi-class models improving by 7.65%.