Software Vulnerability Analysis and Discovery Using Deep Learning Techniques: A Survey

Zeng, Peng; Lin, Guanjun; Pan, Lei; Tai, Yonghang; Zhang, Jun

doi:10.1109/access.2020.3034766

Cited by 47 publications

(30 citation statements)

References 72 publications

(152 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Zou et al ( 2021) also developed a deep learning-based system for multiclass vulnerability detection to identify vulnerabilities in code. Zeng et al (2020) in their study reviewed research works that employed deep learning to detect software vulnerability. Those that used machine learning features are Lin et al (2018) who addressed issues when high quality training data is in deficit.…”

Section: Analysis and Resultsmentioning

confidence: 99%

A systematic literature review of software vulnerability detection

2022

EJCSIT

View full text Add to dashboard Cite

This study provided a systematic literature review of software vulnerability detection (SVD) by searching ACM and IEEE databases for related literatures. Using the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) flowchart, a total of 55 studies published in the selected journals and conference proceeding of IEEE and ACM from 2015 to 2021 were reviewed. The objective is to identify, select and critically evaluate research works carried out on software vulnerability detection. The selected articles were grouped into 7 categories across various vulnerability detection evaluation criteria such as neural network – 5 papers, machine learning – 11 papers, static and dynamic analysis – 8 papers, code clone – 3 papers, classification – 4 papers, models – 3 papers, and frameworks – 6 papers. There are 15 articles that could not fall into any of these 7 categories, thus, they were place in others row that used different criteria to implement vulnerability detection. The result showed that many researchers used machine learning strategy to detect vulnerability in software since large volume of data can be reviewed easily with machine learning. Although many systems have been developed for detecting software vulnerability, none is able to show the type of vulnerability detected.

show abstract

Section: Analysis and Resultsmentioning

confidence: 99%

A systematic literature review of software vulnerability detection

2022

EJCSIT

View full text Add to dashboard Cite

show abstract

“…ere have been several survey articles providing systematic reviews of many approaches in this field from various perspectives [5,[28][29][30][31][32].…”

Section: Related Workmentioning

confidence: 99%

Deep Neural Embedding for Software Vulnerability Discovery: Comparison and Optimization

Yuan

Lin

Tai

et al. 2022

Security and Communication Networks

Self Cite

View full text Add to dashboard Cite

Due to multitudinous vulnerabilities in sophisticated software programs, the detection performance of existing approaches requires further improvement. Multiple vulnerability detection approaches have been proposed to aid code inspection. Among them, there is a line of approaches that apply deep learning (DL) techniques and achieve promising results. This paper attempts to utilize CodeBERT which is a deep contextualized model as an embedding solution to facilitate the detection of vulnerabilities in C open-source projects. The application of CodeBERT for code analysis allows the rich and latent patterns within software code to be revealed, having the potential to facilitate various downstream tasks such as the detection of software vulnerability. CodeBERT inherits the architecture of BERT, providing a stacked encoder of transformer in a bidirectional structure. This facilitates the learning of vulnerable code patterns which requires long-range dependency analysis. Additionally, the multihead attention mechanism of transformer enables multiple key variables of a data flow to be focused, which is crucial for analyzing and tracing potentially vulnerable data flaws, eventually, resulting in optimized detection performance. To evaluate the effectiveness of the proposed CodeBERT-based embedding solution, four mainstream-embedding methods are compared for generating software code embeddings, including Word2Vec, GloVe, and FastText. Experimental results show that CodeBERT-based embedding outperforms other embedding models on the downstream vulnerability detection tasks. To further boost performance, we proposed to include synthetic vulnerable functions and perform synthetic and real-world data fine tuning to facilitate the model learning of C-related vulnerable code patterns. Meanwhile, we explored the suitable configuration of CodeBERT. The evaluation results show that the model with new parameters outperform some state-of-the-art detection methods in our dataset.

show abstract

“…With the success of DL in fields such as image processing, speech recognition, and natural language processing, researchers have been increasingly motivated to apply DL for the SVP domain. Lin et al [13], Singh and Chatuvedi [26], and Zeng et al [16] all conducted an analysis of the deep learning techniques used by researchers for SVP.…”

Section: Existing Svp Reviewsmentioning

confidence: 99%

“…The SV data used to train a model is the most imperative component of this data-driven process. Although most studies have reported data preparation and data quality as significant issues for this research area [4], [10], [13], [16], [17], [24], they have not performed in-depth analysis of the data quality in SVP research to determine the encountered issues or potential solutions. This knowledge gap fails to provide practitioners and researchers with the specific insights needed to remediate data quality issues.…”

Section: Existing Svp Reviewsmentioning

confidence: 99%

“…However, despite the importance and difficulties of SV data preparation for both industry and academia, there has been relatively little effort allocated to systematically understand the known challenges of data preparation for SVP models and how to address them. Whilst there are several secondary studies that have analyzed SVP research [4], [13], [16], [17] and acknowledged the existence of problems with the data preparation, these studies have not focused on thoroughly investigating the data preparation related challenges in SVP research.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Data Preparation for Software Vulnerability Prediction: A Systematic Literature Review

Croft¹,

Xie²,

Babar³

2021

Preprint

View full text Add to dashboard Cite

Software Vulnerability Prediction (SVP) is a data-driven technique for software quality assurance that has recently gained considerable attention in the Software Engineering research community. However, the difficulties of preparing Software Vulnerability (SV) related data remains as the main barrier to industrial adoption. Despite this problem, there have been no systematic efforts to analyse the existing SV data preparation techniques and challenges. Without such insights, we are unable to overcome the challenges and advance this research domain. Hence, we are motivated to conduct a Systematic Literature Review (SLR) of SVP research to synthesize and gain an understanding of the data considerations, challenges and solutions that SVP researchers provide. From our set of primary studies, we identify the main practices for each data preparation step. We then present a taxonomy of 16 key data challenges relating to six themes, which we further map to six categories of solutions. However, solutions are far from complete, and there are several ill-considered issues. We also provide recommendations for future areas of SV data research. Our findings help illuminate the key SV data practices and considerations for SVP researchers and practitioners, as well as inform the validity of the current SVP approaches.

show abstract

Software Vulnerability Analysis and Discovery Using Deep Learning Techniques: A Survey

Cited by 47 publications

References 72 publications

A systematic literature review of software vulnerability detection

A systematic literature review of software vulnerability detection

Deep Neural Embedding for Software Vulnerability Discovery: Comparison and Optimization

Data Preparation for Software Vulnerability Prediction: A Systematic Literature Review

Contact Info

Product

Resources

About