  Recent advances in automated vulnerability detection have achieved potential
results in helping developers determine vulnerable components. However, after
detecting vulnerabilities, investigating to fix vulnerable code is a
non-trivial task. In fact, the types of vulnerability, such as buffer overflow
or memory corruption, could help developers quickly understand the nature of
the weaknesses and localize vulnerabilities for security analysis. In this
work, we investigate the problem of vulnerability type identification (VTI).
The problem is modeled as the multi-label classification task, which could be
effectively addressed by "pre-training, then fine-tuning" framework with deep
pre-trained embedding models. We evaluate the performance of the well-known and
advanced pre-trained models for VTI on a large set of vulnerabilities.
Surprisingly, their performance is not much better than that of the classical
baseline approach with an old-fashioned bag-of-word, TF-IDF. Meanwhile, these
deep neural network approaches cost much more resources and require GPU. We
also introduce a lightweight independent component to refine the predictions of
the baseline approach. Our idea is that the types of vulnerabilities could
strongly correlate to certain code tokens (distinguishing tokens) in several
crucial parts of programs. The distinguishing tokens for each vulnerability
type are statistically identified based on their prevalence in the type versus
the others. Our results show that the baseline approach enhanced by our
component can outperform the state-of-the-art deep pre-trained approaches while
retaining very high efficiency. Furthermore, the proposed component could also
improve the neural network approaches by up to 92.8% in macro-average F1.
