  Though many deep learning (DL)-based vulnerability detection approaches have
been proposed and indeed achieved remarkable performance, they still have
limitations in the generalization as well as the practical usage. More
precisely, existing DL-based approaches (1) perform negatively on prediction
tasks among functions that are lexically similar but have contrary semantics;
(2) provide no intuitive developer-oriented explanations to the detected
results. In this paper, we propose a novel approach named SVulD, a
function-level Subtle semantic embedding for Vulnerability Detection along with
intuitive explanations, to alleviate the above limitations. Specifically, SVulD
firstly trains a model to learn distinguishing semantic representations of
functions regardless of their lexical similarity. Then, for the detected
vulnerable functions, SVulD provides natural language explanations (e.g., root
cause) of results to help developers intuitively understand the
vulnerabilities. To evaluate the effectiveness of SVulD, we conduct large-scale
experiments on a widely used practical vulnerability dataset and compare it
with four state-of-the-art (SOTA) approaches by considering five performance
measures. The experimental results indicate that SVulD outperforms all SOTAs
with a substantial improvement (i.e., 23.5%-68.0% in terms of F1-score,
15.9%-134.8% in terms of PR-AUC and 7.4%-64.4% in terms of Accuracy). Besides,
we conduct a user-case study to evaluate the usefulness of SVulD for developers
on understanding the vulnerable code and the participants' feedback
demonstrates that SVulD is helpful for development practice.
