Abstract
Sensitive Information Exposure (SIEx) vulnerabilities (CWE-200) remain a persistent and under-addressed threat across software systems, often leading to serious security breaches. Existing detection tools rarely target the diverse subcategories of CWE-200 or provide context-aware analysis of code-level data flows. Aims: This paper aims to present SIExVulTS, a novel vulnerability detection system that integrates transformer-based models with static analysis to identify and verify sensitive information exposure in Java applications. Method: SIExVulTS employs a three-stage architecture: (1) an Attack Surface Detection Engine that uses sentence embeddings to identify sensitive variables, strings, comments, and sinks; (2) an Exposure Analysis Engine that instantiates CodeQL queries aligned with the CWE-200 hierarchy; and (3) a Flow Verification Engine that leverages GraphCodeBERT to semantically validate source-to-sink flows. We evaluate SIExVulTS using three curated datasets, including real-world CVEs, a benchmark set of synthetic CWE-200 examples, and labeled flows from 31 open-source projects. Results: The Attack Surface Detection Engine achieved an average F1 score greater than 93\%, the Exposure Analysis Engine achieved an F1 score of 85.71\%, and the Flow Verification Engine increased precision from 22.61\% to 87.23\%. Moreover, SIExVulTS successfully uncovered six previously unknown CVEs in major Apache projects. Conclusions: The results demonstrate that SIExVulTS is effective and practical for improving software security against sensitive data exposure, addressing limitations of existing tools in detecting and verifying CWE-200 vulnerabilities.
Abstract (translated)
敏感信息泄露（SIEx）漏洞（CWE-200）仍然是软件系统中持续存在的、未充分解决的安全威胁，经常导致严重的安全漏洞。现有的检测工具很少针对CWE-200的各种子类别进行目标定位或提供代码级数据流的上下文感知分析。本论文旨在介绍一种名为SIExVulTS的新颖漏洞检测系统，该系统整合了基于Transformer的模型与静态分析技术，以识别和验证Java应用程序中的敏感信息泄露。 **方法：** SIExVulTS采用三阶段架构： 1. **攻击面检测引擎**：使用句子嵌入来识别敏感变量、字符串、注释及接收点。 2. **暴露分析引擎**：实例化与CWE-200层级相匹配的CodeQL查询。 3. **流验证引擎**：利用GraphCodeBERT进行源到接收点数据流的语义验证。 我们使用三个经过整理的数据集来评估SIExVulTS，包括现实世界的CVE、一组合成的CWE-200示例以及来自31个开源项目标记的数据流。 **结果：** 攻击面检测引擎实现了平均F1分数超过93%，暴露分析引擎达到了85.71%的F1分数，而流验证引擎将精度从22.61%提升到了87.23%。此外，SIExVulTS在主要Apache项目中成功发现了六个此前未知的CVE。 **结论：** 结果表明，SIExVulTS对于改进软件安全以防止敏感数据泄露非常有效且实用，解决了现有工具在检测和验证CWE-200漏洞方面的局限性。
URL
https://arxiv.org/abs/2508.19472
