Representation vs. Model: What Matters Most for Source Code Vulnerability Detection

Zheng, Wei; Semasaba, Abubakar Omari Abdallah; Wu, Xiaoxue; Agyemang, Samuel Akwasi; Liu, Tao; Ge, Yuan

doi:10.1109/saner50967.2021.00082

Cited by 3 publications

(1 citation statement)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In Ref. [24], Guo et al propose VULNEXPLORE, a code-based vulnerability detection strategy, using a code metric dataset to detect vulnerability applying LSTM and examine the implied relationships between various code metrics while practically validating a positive association between code metrics and vulnerability production [25][26][27][28][29]. They developed a web service-based VPMs with file granularity for predicting vulnerable components (files).…”

Section: Related Workmentioning

confidence: 99%

A deep learning‐based approach for software vulnerability detection using code metrics

Subhan

et al. 2022

IET Software

Self Cite

View full text Add to dashboard Cite

Vulnerabilities can have devastating effects on information security, affecting the economy, social stability, and national security. The idea of automatic vulnerability detection has always attracted researchers. From traditional manual vulnerability mining techniques to static and dynamic detection, all rely on human experts for feature definition. The rapid development of machine learning and deep learning has alleviated the tedious task of manually defining features by human experts while reducing the lack of objectivity caused by human subjective awareness. However, it is still necessary to find an objective characterisation method to define the features of vulnerabilities. Therefore, the authors use code metrics for code characterisation, sequences of metrics representing code. To use code metrics for vulnerability detection, a deep learning‐based vulnerability detection approach that uses a composite neural network of convolutional neural network (CNN) with long short‐term memory (LSTM) is proposed. The authors conduct experiments independently using the proposed approach for CNN‐LSTM CNN, LSTM, gated recurrent units (GRU), and deep neural network (DNN). The authors’ experimental results show that CNN‐LSTM has a high precision of 92%, a recall of 99%, and an accuracy of 91%. In terms of the F1‐score, it is 95%, compared to previous research results, which indicated an improvement of 18%. Compared to other deep learning‐based vulnerability detection models, the authors’ proposed model produced a lower false‐positive rate, a lower miss rate, and improved accuracy.

show abstract