Deep Learning for Software Vulnerabilities Detection Using Code Metrics

Abstract

Software vulnerability can cause disastrous consequences for information security. Earlier detection of vulnerabilities minimizes these consequences. Manual detection of vulnerable code is very difficult and very costly in terms of time and budget. Therefore, developers must use automatic vulnerabilities prediction (AVP) tools to minimize costs. Recent works on AVP begin to use techniques of deep learning (DL). All the proposed approaches are based on techniques of feature extraction inspired by previous applications of DL such as automatic language processing. Code metrics were widely used as features to build AVP models based on classic machine learning. This study bridges the gap between deep learning and machine learning features and discusses a deep-learning-based approach to finding vulnerabilities in code using code metrics. Obtained results show that code metrics are very good but not the better to use as features in DL-based AVP.INDEX TERMS Automatic vulnerability prediction, code metrics, deep neural networks.

إستعراض منهجی للأدبیات حول الکشف عن نقاط ضعف البرمجیات بإستخدام أسالیب تعلم الألة

“…One of the key research directions is to develop intelligent vulnerability detection techniques that act on source code. The following three sub-categories can be found: vulnerability detection methods based on software metrics [18] [19] [20] [21], anomaly detection technique for detecting vulnerabilities by looking for abnormal patterns [22], and vulnerable pattern learning [23].…”

“…[19] [46] [47] [18]. Mohammed et al [20] Aim to use code metrics as features to detect software vulnerabilities based on deep learning with a fine granularity level. The findings showed that code metrics are good, but not ideal to be used as features in DL-based vulnerability detection.…”

“…By applying Machine learning-based techniques to detect vulnerabilities, features can be developed automatically [35] [36] [37], eliminating the need for human experts to manually define the features, which frequently overlooks many vulnerabilities. In addition to one of the primary studies used code metrics for defining code characteristics [20].…”

Detecting vulnerability in source code using CNN and LSTM network

“…Recent research has used deep learning on code features to detect vulnerabilities in code. Unlike traditional detection methods, deep learning does not require researchers to manually perform extensive processing of code features and can automatically determine the relationship of features in the sample data from the training samples [9][10][11][12][13][14][15][16].…”

Detecting Vulnerability in Source Code Using CNN and LSTM Network

“…Recent research has used deep learning on code features to detect vulnerabilities in code. Unlike traditional detection methods, deep learning does not require researchers to manually perform extensive processing of code features and can automatically determine the relationship of features in the sample data from the training samples [9][10][11][12][13][14][15][16].…”