The application of neural network for software vulnerability detection: a review

Zhu, Yuhui; Lin, Guanjun; Song, Lipeng; Zhang, Jun

doi:10.1007/s00521-022-08046-y

Cited by 9 publications

(5 citation statements)

References 90 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This method has high code coverage but is usually more prone to false positives [4,9,10]. Dynamic analysis is performed by running a set of test cases in the target system and analyzing its behaviour according to the actual requirements [3,4,9,16]. This method has higher miss rate and achieves less coverage, but it is generally more accurate and raises fewer false alarms [9].…”

Section: State Of the Artmentioning

confidence: 99%

“…SVD is the process of identifying weaknesses or flaws within software systems. It can be performed via two different analysis methods: (i) static and (ii) dynamic [9]. Static analysis consists of analyzing the source code to detect vulnerabilities.…”

Section: State Of the Artmentioning

confidence: 99%

“…Static analysis consists of analyzing the source code to detect vulnerabilities. This method has high code coverage but is usually more prone to false positives [4,9,10]. Dynamic analysis is performed by running a set of test cases in the target system and analyzing its behaviour according to the actual requirements [3,4,9,16].…”

Section: State Of the Artmentioning

confidence: 99%

“…Dynamic analysis is performed by running a set of test cases in the target system and analyzing its behaviour according to the actual requirements [3,4,9,16]. This method has higher miss rate and achieves less coverage, but it is generally more accurate and raises fewer false alarms [9]. In comparison to one another, dynamic analysis requires a substantial amount of computational power to generate and run multiple test cases in the System Under Test (SUT), whereas static analysis does not.…”

Section: State Of the Artmentioning

confidence: 99%

“…Since manual analysis of source code can be expensive and time-consuming, recent research has attempted to automate SVD using Deep Learning (DL). Literature works have been experimenting with various models and feature representations including implicit structural, syntax, and semantic features extracted from the source code [9,10]. Despite their efficacy in SVD, DL models face several limitations due to the complex nature of source code and lack of reliable data [4,11].…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Large Language Models for Source Code Vulnerability Detection: A DiverseVul Analysis

Dias,

Gonçalves,

Maia

et al. 2024

Preprint

View full text Add to dashboard Cite

Software's pervasive impact and increasing reliance in the era of digital transformation raises concerns about vulnerabilities. The emergence of code assistants for code generation further aggravates this issue, emphasizing the critical need for prioritizing software security. In recent research, DL has become a very promising instrument for vulnerability detection, with most recent approaches utilizing LLMs for Software Vulnerability Detection. The data utilized in this context is curated from real-world projects or synthetically, with the latter achieving great metric scores but poor performance in a real context. Driven by this issue, DiverseVul has been curated to be the largest dataset containing C/C++ vulnerable and non-vulnerable functions extracted from real-world projects. This work intends to explore this dataset by using it to fine-tune three LLMs (i.e.: CodeBERT, CodeGPT, and NatGen), evaluating their performance on vulnerability detection. During data processing, several erroneous data points were found, motivating the creation of a refined version of the dataset. Moreover, to establish a comparable baseline, the same models were fine-tuned on the RCVEFixes dataset, which is a refined version of the CVEFixes dataset containing only C/C++ functions. The results show that the best-performing models were CodeBERT trained on DiverseVul with 69% F1-Score and NatGen trained on RVCEFixes with 53%. It can be concluded that the performance of CodeBERT trained on DiverseVul is generally higher than average literature using similar techniques.

show abstract