Detecting vulnerability in source code using CNN and LSTM network

Abstract

Vulnerabilities can have very serious consequences for information security, with huge implications for economic, social, and even national security. Automated vulnerability detection has always been a keen topic for researchers. From traditional manual vulnerability mining to static detection and dynamic detection, all rely on human experts to define features. The rapid development of machine learning and deep learning has alleviated the tedious task of manually defining features by human experts while reducing the lack of objectivity caused by human subjective awareness.However, we still need to find an objective characterization method to define the features of vulnerabilities. Therefore, we use code metrics for code characterization, which are sequences of metrics that represent code. To use code metrics for vulnerability detection, we propose VulnExplore, a deep learning-based vulnerability detection model that uses a composite neural network of CNN+LSTM for feature extraction and learning of code metrics. Experimental results show that VulnExplore has a lower false positive rate, a lower miss rate, and a better accuracy rate compared to other deep learning-based vulnerability detection models.

SFN: A Novel Scalable Feature Network for Vulnerability Representation of Open-Source Codes

“…Zagane et al [23] constructed a data set containing 16 code metrics from publicly available data sets and, unlike previous approaches using long-and shortterm memory networks and K-neighborhood algorithms, the proposed vulnerability detection model uses Multi-Layer Perceptron (MLP) for representation learning and achieves 76.9% accuracy in the real-world code metric data set. In addition, based on the existing code metric-based vulnerability detection, Guo et al [24] constructed a data set containing 21 code metrics, including two new complexity metrics, and proposed a compound deep learning-based vulnerability model VulExplore for this data set. e model obtained a precision of over 81% and reduced both the FNR and FPR to under 20%.…”

VulGraB: Graph‐embedding‐based code vulnerability detection with bi‐directional gated graph neural network

“…Research has evolved from early applications of multi-layer perceptron (MLP) to more recent studies using CNNs or LSTMs, 42,43 and until recently using GNNs-based approaches. 44 The evolving network structure suggests that researchers have invested a significant amount of research effort to explore the potential of neural networks for semantic reasoning about code, as well as for facilitating rich patterns of vulnerability discovery.…”

“…Network models for vulnerability detection are becoming more sophisticated and expressive in order to better learn the code semantics of vulnerable code fragments, and to reduce the amount of effort required for code analysis efforts. Research has evolved from early applications of multi‐layer perceptron (MLP) to more recent studies using CNNs or LSTMs, 42,43 and until recently using GNNs‐based approaches 44 . The evolving network structure suggests that researchers have invested a significant amount of research effort to explore the potential of neural networks for semantic reasoning about code, as well as for facilitating rich patterns of vulnerability discovery.…”

Low Level Source Code Vulnerability Detection Using Advanced BERT Language Model

“…But these algorithms have failed to provide high levels of accuracy. After the deep learning evolution, some researchers have applied convolutional neural network (CNN), recurrent network (RNN), and long short term memory (LSTM) options to detect different kinds of vulnerabilities [16] [17]. These deep learning models can provide an advanced performance than common machine learning algorithms and the accuracy of experimental results are also better than previous traditional machine learning algorithms.…”