  Fine-grained software vulnerability detection is an important and challenging
problem. Ideally, a detection system (or detector) not only should be able to
detect whether or not a program contains vulnerabilities, but also should be
able to pinpoint the type of a vulnerability in question. Existing
vulnerability detection methods based on deep learning can detect the presence
of vulnerabilities (i.e., addressing the binary classification or detection
problem), but cannot pinpoint types of vulnerabilities (i.e., incapable of
addressing multiclass classification). In this paper, we propose the first deep
learning-based system for multiclass vulnerability detection, dubbed
$\mu$VulDeePecker. The key insight underlying $\mu$VulDeePecker is the concept
of code attention, which can capture information that can help pinpoint types
of vulnerabilities, even when the samples are small. For this purpose, we
create a dataset from scratch and use it to evaluate the effectiveness of
$\mu$VulDeePecker. Experimental results show that $\mu$VulDeePecker is
effective for multiclass vulnerability detection and that accommodating
control-dependence (other than data-dependence) can lead to higher detection
capabilities.
