  Vulnerability detection is a crucial component in the software development
lifecycle. Existing vulnerability detectors, especially those based on deep
learning (DL) models, have achieved high effectiveness. Despite their
capability of detecting vulnerable code snippets from given code fragments, the
detectors are typically unable to further locate the fine-grained information
pertaining to the vulnerability, such as the precise vulnerability triggering
locations.In this paper, we propose VULEXPLAINER, a tool for automatically
locating vulnerability-critical code lines from coarse-level vulnerable code
snippets reported by DL-based detectors.Our approach takes advantage of the
code structure and the semantics of the vulnerabilities. Specifically, we
leverage program slicing to get a set of critical program paths containing
vulnerability-triggering and vulnerability-dependent statements and rank them
to pinpoint the most important one (i.e., sub-graph) as the data flow
associated with the vulnerability. We demonstrate that VULEXPLAINER performs
consistently well on four state-of-the-art graph-representation(GP)-based
vulnerability detectors, i.e., it can flag the vulnerability-triggering code
statements with an accuracy of around 90% against eight common C/C++
vulnerabilities, outperforming five widely used GNN-based explanation
approaches. The experimental results demonstrate the effectiveness of
VULEXPLAINER, which provides insights into a promising research line:
integrating program slicing and deep learning for the interpretation of
vulnerable code fragments.
