Abstract:Context: Identifying potential vulnerable code is important to improve the security of our software systems. However, the manual detection of software vulnerabilities requires expert knowledge and is time-consuming, and must be supported by automated techniques. Objective: Such automated vulnerability detection techniques should achieve a high accuracy, point developers directly to the vulnerable code fragments, scale to real-world software, generalize across the boundaries of a specific software project, and require no or only moderate setup or configuration effort. Method: In this article, we present Vudenc (Vulnerability Detection with Deep Learning on a Natural Codebase), a deep learning-based vulnerability detection tool that automatically learns features of vulnerable code from a large and real-world Python codebase. Vudenc applies a word2vec model to identify semantically similar code tokens and to provide a vector representation. A network of long-short-term memory cells (LSTM) is then used to classify vulnerable code token sequences at a fine-grained level, highlight the specific areas in the source code that are likely to contain vulnerabilities, and provide confidence levels for its predictions. Results: To evaluate Vudenc, we used 1,009 vulnerability-fixing commits from different GitHub repositories that contain seven different types of vulnerabilities (SQL injection, XSS, Command injection, XSRF, Remote code execution, Path disclosure, Open redirect) for training. In the experimental evaluation, Vudenc achieves a recall of 78%–87%, a precision of 82%–96%, and an F1 score of 80%–90%. Vudenc’s code, the datasets for the vulnerabilities, and the Python corpus for the word2vec model are available for reproduction. Conclusions: Our experimental results suggest that Vudenc is capable of outperforming most of its competitors in terms of vulnerably detection capabilities on real-world software. Comparable accuracy was only achieved on synthetic benchmarks, within single projects, or on a much coarser level of granularity such as entire source code files.

Few-VulD: A Few-shot learning framework for software vulnerability detection

Function-Level Vulnerability Detection Through Fusing Multi-Modal Knowledge

A Method of Few-Shot Network Intrusion Detection Based on Meta-Learning Framework

DeepVulSeeker: A novel vulnerability identification framework via code graph structure and pre-training mechanism

DiverseVul: A New Vulnerable Source Code Dataset for Deep Learning Based Vulnerability Detection

A Survey of Few-Shot Learning: An Effective Method for Intrusion Detection

VulDeePecker: A Deep Learning-Based System for Vulnerability Detection

VUDENC: Vulnerability Detection with Deep Learning on a Natural Codebase for Python

Dataflow Analysis-Inspired Deep Learning for Efficient Vulnerability Detection

VulSniper: Focus Your Attention to Shoot Fine-Grained Vulnerabilities

COCL: an Intelligent Framework for Enhancing Deep Learning-Based Vulnerability Detection

$μ$VulDeePecker: A Deep Learning-Based System for Multiclass Vulnerability Detection

SySeVR: A Framework for Using Deep Learning to Detect Software Vulnerabilities

Transformer-based Vulnerability Detection in Code at EditTime: Zero-shot, Few-shot, or Fine-tuning?

Boosting the Capability of Intelligent Vulnerability Detection by Training in a Human-Learning Manner

Few-Sample Named Entity Recognition for Security Vulnerability Reports by Fine-Tuning Pre-Trained Language Models

A few-shot deep learning approach for improved intrusion detection

CD-VulD: Cross-Domain Vulnerability Discovery Based on Deep Domain Adaptation

VulMPFF: A Vulnerability Detection Method for Fusing Code Features in Multiple Perspectives

VulEval: Towards Repository-Level Evaluation of Software Vulnerability Detection