Abstract:Context: Desirable characteristics in vulnerability-detection (VD) systems (VDSs) include both good detection capability (high accuracy, low false positive rate, low false negative rate, etc.) and low time overheads. The widely used VDSs based on models such as Recurrent Neural Networks (RNNs) have some problems, such as low time efficiency, failing to learn the vulnerability features better, and insufficent amounts of vulnerability features. Therefore, it is very important to construct an automatic detection model with high detection accuracy. Objective: This paper reports on training based on the source code to analyze and learn from the code's patterns and structures by deep-learning techniques to generate an efficient VD model that does not require manual feature design. Method: We propose a software VD model based on multi-feature fusion and deep neural networks called AIdetectorX-SP. It first uses a Temporal Convolutional Network (TCN) and adds a Self-attention Mechanism (SaM) to the TCN to build a model for extracting vulnerability logic features, then transforms the source code into an image input to a Convolutional Neural Network (CNN) to extract structural and semantic information. Finally, we use feature-fusion technology to design and implement an improved deep-learning-based VDS, called AIdetectorX Sequence with Picturization (AIdetectorX-SP). Results: We report on experiments conducted using publicly-available and widely-used datasets to evaluate the effectiveness of AIdetectorX-SP, with results indicating that AIdetectorX-SP is an effective VDS; that the combination of TCN and SaM can effectively extract vulnerability logic features; and that the pictorial code can extract code structure features, which can further improve the VD capability. Conclusion: In this paper, we propose a novel detection model for software vulnerability based on TCNs, SaM, and software picturization. The proposed model solves some shortcomings and limitations of existing VDSs, and obtains a high software-VD accuracy with a high degree of stability.

Interpreting Deep Learning-based Vulnerability Detector Predictions Based on Heuristic Searching

Function-Level Vulnerability Detection Through Fusing Multi-Modal Knowledge

Beyond Fidelity: Explaining Vulnerability Localization of Learning-based Detectors

Towards Making Deep Learning-based Vulnerability Detectors Robust

A Comparative Study of Deep Learning-Based Vulnerability Detection System

Deep Learning based Vulnerability Detection: Are We There Yet?

VulDeePecker: A Deep Learning-Based System for Vulnerability Detection

Understanding and Tackling Label Errors in Deep Learning-Based Vulnerability Detection (experience Paper).

Interpretable Deep Learning under Fire

mVulPreter: A Multi-Granularity Vulnerability Detection System With Interpretations

DeepVulSeeker: A novel vulnerability identification framework via code graph structure and pre-training mechanism

VDDL: A Deep Learning-Based Vulnerability Detection Model for Smart Contracts.

Hybrid semantics-based vulnerability detection incorporating a Temporal Convolutional Network and Self-attention Mechanism

VDDA: An Effective Software Vulnerability Detection Model Based on Deep Learning and Attention Mechanism

Toward Improved Deep Learning-based Vulnerability Detection

Learning-based Models for Vulnerability Detection: An Extensive Study

Dataflow Analysis-Inspired Deep Learning for Efficient Vulnerability Detection

VulDeeLocator: A Deep Learning-based Fine-grained Vulnerability Detector

Boosting the Capability of Intelligent Vulnerability Detection by Training in a Human-Learning Manner

The Vulnerability Is in the Details: Locating Fine-grained Information of Vulnerable Code Identified by Graph-based Detectors