Abstract:Context: Desirable characteristics in vulnerability-detection (VD) systems (VDSs) include both good detection capability (high accuracy, low false positive rate, low false negative rate, etc.) and low time overheads. The widely used VDSs based on models such as Recurrent Neural Networks (RNNs) have some problems, such as low time efficiency, failing to learn the vulnerability features better, and insufficent amounts of vulnerability features. Therefore, it is very important to construct an automatic detection model with high detection accuracy. Objective: This paper reports on training based on the source code to analyze and learn from the code's patterns and structures by deep-learning techniques to generate an efficient VD model that does not require manual feature design. Method: We propose a software VD model based on multi-feature fusion and deep neural networks called AIdetectorX-SP. It first uses a Temporal Convolutional Network (TCN) and adds a Self-attention Mechanism (SaM) to the TCN to build a model for extracting vulnerability logic features, then transforms the source code into an image input to a Convolutional Neural Network (CNN) to extract structural and semantic information. Finally, we use feature-fusion technology to design and implement an improved deep-learning-based VDS, called AIdetectorX Sequence with Picturization (AIdetectorX-SP). Results: We report on experiments conducted using publicly-available and widely-used datasets to evaluate the effectiveness of AIdetectorX-SP, with results indicating that AIdetectorX-SP is an effective VDS; that the combination of TCN and SaM can effectively extract vulnerability logic features; and that the pictorial code can extract code structure features, which can further improve the VD capability. Conclusion: In this paper, we propose a novel detection model for software vulnerability based on TCNs, SaM, and software picturization. The proposed model solves some shortcomings and limitations of existing VDSs, and obtains a high software-VD accuracy with a high degree of stability.

Hierarchical Attention Network for Interpretable and Fine-Grained Vulnerability Detection

Function-Level Vulnerability Detection Through Fusing Multi-Modal Knowledge

Snopy: Bridging Sample Denoising with Causal Graph Learning for Effective Vulnerability Detection

Fine-grained Commit-level Vulnerability Type Prediction by CWE Tree Structure.

Ignnvd: A Novel Software Vulnerability Detection Model Based on Integrated Graph Neural Networks

Multi-context Attention Fusion Neural Network for Software Vulnerability Identification

Meta-Path Based Attentional Graph Learning Model for Vulnerability Detection

VulSniper: Focus Your Attention to Shoot Fine-Grained Vulnerabilities

Vulnerability Detection with Graph Attention Network and Metric Learning

Interpreting Deep Learning-based Vulnerability Detector Predictions Based on Heuristic Searching

mVulPreter: A Multi-Granularity Vulnerability Detection System With Interpretations

Hybrid semantics-based vulnerability detection incorporating a Temporal Convolutional Network and Self-attention Mechanism

VulANalyzeR: Explainable Binary Vulnerability Detection with Multi-task Learning and Attentional Graph Convolution

HGVul: A Code Vulnerability Detection Method Based on Heterogeneous Source-Level Intermediate Representation

Vulnerability Detection for Source Code Using Contextual LSTM

GraphEye: A Novel Solution for Detecting Vulnerable Functions Based on Graph Attention Network

Beyond Fidelity: Explaining Vulnerability Localization of Learning-based Detectors

SCVHunter: Smart Contract Vulnerability Detection Based on Heterogeneous Graph Attention Network

A Hierarchical Deep Neural Network for Detecting Lines of Codes with Vulnerabilities

The Vulnerability Is in the Details: Locating Fine-grained Information of Vulnerable Code Identified by Graph-based Detectors