Abstract:Software vulnerability detection is critical in software security because it identifies potential bugs in software systems, enabling immediate remediation and mitigation measures to be implemented before they may be exploited. Automatic vulnerability identification is important because it can evaluate large codebases more efficiently than manual code auditing. Many Machine Learning (ML) and Deep Learning (DL) based models for detecting vulnerabilities in source code have been presented in recent years. However, a survey that summarises, classifies, and analyses the application of ML/DL models for vulnerability detection is missing. It may be difficult to discover gaps in existing research and potential for future improvement without a comprehensive survey. This could result in essential areas of research being overlooked or under-represented, leading to a skewed understanding of the state of the art in vulnerability detection. This work address that gap by presenting a systematic survey to characterize various features of ML/DL-based source code level software vulnerability detection approaches via five primary research questions (RQs). Specifically, our RQ1 examines the trend of publications that leverage ML/DL for vulnerability detection, including the evolution of research and the distribution of publication venues. RQ2 describes vulnerability datasets used by existing ML/DL-based models, including their sources, types, and representations, as well as analyses of the embedding techniques used by these approaches. RQ3 explores the model architectures and design assumptions of ML/DL-based vulnerability detection approaches. RQ4 summarises the type and frequency of vulnerabilities that are covered by existing studies. Lastly, RQ5 presents a list of current challenges to be researched and an outline of a potential research roadmap that highlights crucial opportunities for future work.

A Survey of Feature Selection for Vulnerability Prediction Using Feature-based Machine Learning

Categorizing and Predicting Invalid Vulnerabilities on Common Vulnerabilities and Exposures

Survey on Software Vulnerability Analysis Method Based on Machine Learning.

Combining Software Metrics and Text Features for Vulnerable File Prediction

Towards More Practical Automation of Vulnerability Assessment

Explaining the Contributing Factors for Vulnerability Detection in Machine Learning

A Survey on Automated Software Vulnerability Detection Using Machine Learning and Deep Learning

A Survey for Study of Feature Selection Algorithms

A performance evaluation of deep‐learnt features for software vulnerability detection

The impact factors on the performance of machine learning-based vulnerability detection: A comparative study

An empirical study of text-based machine learning models for vulnerability detection

A multi-target approach to estimate software vulnerability characteristics and severity scores

Predicting Vulnerability Type in Common Vulnerabilities and Exposures (CVE) Database with Machine Learning Classifiers

Predicting Exploitation of Disclosed Software Vulnerabilities Using Open-source Data

A Comparative Study of Deep Learning-Based Vulnerability Detection System

A Mining Approach to Obtain the Software Vulnerability Characteristics

Software vulnerability prediction using text analysis techniques

Vulnerability Time Series Prediction Based on Multivariable LSTM

Software Vulnerability Detection Using Deep Neural Networks: A Survey

Learning-based Models for Vulnerability Detection: An Extensive Study