Detecting software vulnerabilities using deep learning
Abstract
Developing software projects successful is always a top concern for organizations and enterprises. Among these concerns, ensuring software quality is the highest priority throughout the entire development and operation process. This paper addresses the detection of source code vulnerabilities and focuses on analyzing the syntax and semantics of statements within the source code. The source code vulnerability detection model follows a structured process: (i) syntactic and semantic representation; (ii) feature extraction from source code; (iii) data balancing; and (iv) source code classification. The model’s output indicates whether the source code is normal or contains vulnerabilities. The model is trained using the SARD dataset and incorporates deep learning approaches. Specifically, it employs the BERT (Bidirectional Encoder Representations from Transformers) model, the Word2Vec model combined with LSTM (Long Short-Term Memory), and the Word2Vec model with BiLSTM (Bidirectional Long Short-Term Memory) across three scenarios. Classification results are passed through a softmax function to generate a vector containing the probability predictions for each type of vulnerability. The detection model achieves an accuracy rate of up to 82.63% for identifying source code vulnerabilities, with a corresponding omission rate of only 17.37%. This result is considered acceptable and demonstrates the superior effectiveness of the approach in the task of source code vulnerability detection.
References
[2] B. Liu, W. Guan, C. Yang, et al. (2023), “Transformer and graph convolutional network for text classification”, International Journal of Computational Intelligence Systems, 16, DOI: 10.1007/s44196-023-00337-z.
[3] J. Devlin, M.W. Chang, K. Lee, et al. (2019), “Bert: Pre-training of deep bidirectional transformers for language understanding”, The 2019 Conference of The North American Chapter of The Association for Computational Linguistics: Human Language Technologies, 1, pp.4171-4186, DOI: 10.18653/v1/N19-1423.
[4] D.X. Cho, H.M. Dao, M.T. Cong, et al. (2023), “A novel approach for software vulnerability detection based on intelligent cognitive computing”, The Journal of Supercomputing, 79, pp.17042-17078, DOI: 10.1007/ s11227-023-05282-4.
[5] G. Lin, S. Wen, Q.L. Han, et al. (2020), “Software vulnerability detection using deep neural networks: A survey”, Proceedings of The IEEE, 108(10), pp.1825-1848, DOI: 10.1109/JPROC.2020.2993293.
[6] P. Zeng, G. Lin, L. Pan, et al. (2020), “Software vulnerability analysis and discovery using deep learning techniques: A survey”, IEEE Access, 8, pp.197158-197172, DOI: 10.1109/ACCESS.2020.3034766.
[7] H. Wang, G. Ye, Z. Tang, et al. (2021), “Combining graph-based learning with automated data collection for code vulnerability detection”, IEEE Transactions on Information Forensics and Security, 16, pp.1943-1958, DOI: 10.1109/ TIFS.2020.3044773.
[8] X. Li, L. Wang, Y. Xin, et al. (2021), “Automated software vulnerability detection based on hybrid neural network”, Applied Sciences, 11(7), DOI: 10.3390/ app11073201.
[9] H. Wei, M. Li (2017), “Supervised deep features for software functional clone detection by exploiting lexical and syntactical information in source code”, Proceedings of The TwentySixth International Joint Conference on Artificial Intelligence, pp.3034-3040.
[10] G. Siewruk, W. Mazurczyk (2021), “Contextaware software vulnerability classification using machine learning”, IEEE Access, 9, pp.88852-88867, DOI: 10.1109/ ACCESS.2021.3075385.
[11] X. Li, L. Wang, Y. Xin, et al. (2020), “Automated vulnerability detection in source code using minimum intermediate representation learning”, Appl. Sci., 10, DOI: 10.3390/app10051692.
[12] W. Zheng, J. Gao, X. Wu, et al. (2020), “The impact factors on the performance of machine learningbased vulnerability detection: A comparative study”, The Journal of Systems & Software, 168(7), DOI: 10.1016/j. jss.2020.110659.
[13] R.L. Russell, L. Kim, L.H. Hamilton, et al. (2018), “Automated vulnerability detection in source code using deep representation learning”, 2018 17th IEEE International Conference on Machine Learning and Applications (ICMLA), pp.757-762, DOI: 10.1109/ICMLA.2018.00120.
[14] P. Haridas, G. Chennupati, N. Santhi, et al. (2020), “Code characterization with graph convolutions and capsule networks”, IEEE Access, 8, pp.136307-136315, DOI: 10.1109/ACCESS.2020.3011909.
[15] Z. Li, D. Zou, J. Tang, et al. (2019), “A comparative study of deep learning-based vulnerability detection system”, IEEE Access, 7, pp.103184-103197, DOI: 10.1109/ ACCESS.2019.2930578.
[16] F. Yamaguchi, M. Lottmann, K. Rieck (2012), “Generalized vulnerability extrapolation using abstract syntax trees”, Annual Computer Security Applications Conference, 28, pp.358-368.
[17] H. Gascon, F. Yamaguchi, D. Arp, et al. (2013), “Structural detection of android malware using embedded call graphs”, ACM Workshop on Artificial Intelligence and Security, pp.45-54.
[18] K. Ferrante, J. OttensteinJoe, D. Warren (1989), “The program dependence graph and its use in optimization”, ACM Transactions on Programming Languages and Systems, 9(3), pp.319-349.
[19] D.X. Cho (2023), “A new approach to software vulnerability detection based on CPG analysis”, Cogent Engineering, 10(1), DOI: 10.1080/23311916.2023.2221962.
[20] R. Krishna, Y. Ding, B. Ray (2022), “Deep learning based vulnerability detection: Are we there yet?”, IEEE Transactions on Software Engineering, 48(9), pp.3280-3296, DOI: 10.1109/TSE.2021.3087402.
[21] F. Yamaguchi, N. Golde, D. Arp, et al. (2014), “Modeling and discovering vulnerabilities with code property graphs”, IEEE Symposium on Security and Privacy, pp.590-604, DOI: 10.1109/SP.2014.44.
[22] N.V. Chawla, K.W. Bowyer, L.O. Hall, et al. (2002), “SMOTE: Synthetic minority over-sampling technique”, Journal of Artificial Intelligence Research, 16, pp.321-357.
[23] E. Hoffer, N. Ailon (2015), “Deep metric learning using triplet network”, International Workshop on SimilarityBased Pattern Recognition, pp.84-92.
[24] Z. Li, D. Zou, S. Xu, et al. (2018), “VulDeePecker: A deep learning-based system for vulnerability detection”, arXiv, DOI: 10.14722/ndss.2018.23158.
[25] Z. Li, D. Zou, S. Xu, et al. (2018), “SySeVR: A framework for using deep learning to detect software vulnerabilities”, IEEE Transactions on Dependable and Secure Computing, 19(4), DOI: 10.1109/TDSC.2021.3051525.
