  Automated detection of software vulnerabilities is a fundamental problem in
software security. Existing program analysis techniques either suffer from high
false positives or false negatives. Recent progress in Deep Learning (DL) has
resulted in a surge of interest in applying DL for automated vulnerability
detection. Several recent studies have demonstrated promising results achieving
an accuracy of up to 95% at detecting vulnerabilities. In this paper, we ask,
"how well do the state-of-the-art DL-based techniques perform in a real-world
vulnerability prediction scenario?". To our surprise, we find that their
performance drops by more than 50%. A systematic investigation of what causes
such precipitous performance drop reveals that existing DL-based vulnerability
prediction approaches suffer from challenges with the training data (e.g., data
duplication, unrealistic distribution of vulnerable classes, etc.) and with the
model choices (e.g., simple token-based models). As a result, these approaches
often do not learn features related to the actual cause of the vulnerabilities.
Instead, they learn unrelated artifacts from the dataset (e.g., specific
variable/function names, etc.). Leveraging these empirical findings, we
demonstrate how a more principled approach to data collection and model design,
based on realistic settings of vulnerability prediction, can lead to better
solutions. The resulting tools perform significantly better than the studied
baseline: up to 33.57% boost in precision and 128.38% boost in recall compared
to the best performing model in the literature. Overall, this paper elucidates
existing DL-based vulnerability prediction systems' potential issues and draws
a roadmap for future DL-based vulnerability prediction research. In that
spirit, we make available all the artifacts supporting our results:
https://git.io/Jf6IA.
