A Lightweight Assisted Vulnerability Discovery Method Using Deep Neural Networks

Li, Runhao; Feng, Chao; Zhang, Xing; Tang, Chaojing

doi:10.1109/access.2019.2923227

Cited by 22 publications

(27 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The discovery of these lines of code with a higher accuracy allows for the focus on those specific code lines since the probability of its vulnerability is higher. This vulnerability aspect is focused on by several of the surveyed papers [15, 17, 78–87 ] Table 7.…”

Section: Taxonomy Of Deep Learning Techniques For Source Code Vulnementioning

confidence: 99%

“…Among the reviewed works several of them use some form of RNNs. classical RNNs [86 ], long short‐term memory (LSTM) [16, 67, 69, 70, 73, 76, 83 ], contextual long short‐term memory (CLSTM) [72 ], bidirectional recurrent neural networks (BRNNs) [17, 74 ], bidirectional gated recurrent unit (BGRU) [83 ], and bidirectional long short‐term memory (BLSTM) [14, 15, 19, 77, 79, 82–85 ].…”

Section: Taxonomy Of Deep Learning Techniques For Source Code Vulnementioning

confidence: 99%

“…This issue has been highlighted by several reviewed papers as a limitation that can be explored in the future. On several of the surveyed works the programming language of the data set focus ranges from C/C++ [14, 15, 17, 19, 69–72, 77–87 ] and JavaScript [18, 60, 79 ]. Having a data set that consists of multiple programming languages would require further exploration.…”

Section: Issues and Challengesmentioning

confidence: 99%

“…This research direction involves using multiple programming language data sets for a DL model and studying their impact on different metrics for vulnerability detection. This direction of vulnerability detection was studied in the work of [79, 82 ]. The authors explored the viability of this approach by using operational semantics of a data set of C/C++ and Python files.…”

Section: Topical Trendsmentioning

confidence: 99%

“…Some of the reviewed works use a single form of graphical representation for their feature extraction [14–19, 71, 73, 75, 80, 87 ] (b) Code block‐based feature representation: For code block‐based feature representation, studies under this category utilise DNNs for extracting feature representations from sequential code entities such as function calls, code snippets, code gadgets, and so on. Some of the reviewed papers rely on the use of code block‐based representations of source code [67, 70, 72, 74, 76, 77, 82, 83, 85 ] (c) Text‐based feature representation: For this category of feature, representations are learned directly from the source code text surface. Examples include Lexed code representation and using the source code files directly.…”

Section: Taxonomy Of Deep Learning Techniques For Source Code Vulnementioning

confidence: 99%

See 4 more Smart Citations

Literature survey of deep learning-based vulnerability analysis on source code

Semasaba

Zheng

et al. 2020

IET Software

View full text Add to dashboard Cite

Vulnerabilities in software source code are one of the critical issues in the realm of software code auditing. Due to their high impact, several approaches have been studied in the past few years to mitigate the damages from such vulnerabilities. Among the approaches, deep learning has gained popularity throughout the years to address such issues. In this literature survey, the authors provide an extensive review of the many works in the field software vulnerability analysis that utilise deep learning‐based techniques. The reviewed works are systemised according to their objectives (i.e. the type of vulnerability analysis aspect), the area of focus (i.e. the focus area of the analysis), what information about source code is used (i.e. the features), and what deep learning techniques they employ (i.e. what algorithm is used to process the input and produce the output). They also study the limitations of the papers and topical trends concerning vulnerability analysis.

show abstract

Section: Taxonomy Of Deep Learning Techniques For Source Code Vulnementioning

confidence: 99%

Section: Taxonomy Of Deep Learning Techniques For Source Code Vulnementioning

confidence: 99%

Section: Issues and Challengesmentioning

confidence: 99%

Section: Topical Trendsmentioning

confidence: 99%

Section: Taxonomy Of Deep Learning Techniques For Source Code Vulnementioning

confidence: 99%

See 3 more Smart Citations

Literature survey of deep learning-based vulnerability analysis on source code

Semasaba

Zheng

et al. 2020

IET Software

View full text Add to dashboard Cite

show abstract

Intelligent detection of vulnerable functions in software through neural embedding‐based code analysis

et al. 2022

View full text Add to dashboard Cite

Summary Software vulnerability is a fundamental problem in cybersecurity, which poses severe threats to the secure operation of devices and systems. In this paper, we propose a new vulnerability detection framework of employing advanced neural embedding. For example, CodeBERT is a large‐scale pre‐trained embedding model for natural language and programming language. It achieves state‐of‐the‐art performance on various natural language processing and code analysis tasks, demonstrating improved generalization ability compared with conventional models. The proposed framework encapsulates CodeBERT as a code representation generator and combines it with transfer learning to conduct cross‐project vulnerability detection. Considering the problem of lacking code embedding models on C source code, we extract the knowledge from C source code to fine‐tune the pre‐trained embedding model, so as to better facilitate the detection of function‐level vulnerabilities in C open‐source projects. To address the severe data imbalance issue in real‐world scenarios, we introduce code argumentation idea and use a large number of synthetic vulnerability data to further improve the robustness of the detection method. Experimental results show that the proposed vulnerability detection framework achieves better performance than existing methods.

show abstract