Abstract:Machine learning methods are widely used to identify common, repeatedly occurring bugs and code vulnerabilities. The performance of a machine-learned model is bounded by the quality and quantity of training data and the model’s capability in extracting and capturing the essential information of the problem domain. Unfortunately, there is a storage of high-quality samples for training code vulnerability detection models, and existing machine learning methods are inadequate in capturing code vulnerability patterns.We present Developer,11Developer = Detecting codE VulnerabilitiEs at the Large scale by learning from OPen sourcE Repositories. a novel learning framework for building code vulnerability detection models. To address the data scarcity challenge, Developer automatically gathers training samples from open-source projects and applies constraints rules to the collected data to filter out noisy data to improve the quality of the collected samples. The collected data provides many real-world vulnerable code training samples to complement the samples available in standard vulnerable databases. To build an effective code vulnerability detection model, Developer employs a convolutional neural network architecture with attention mechanisms to extract code representation from the program abstract syntax tree. The extracted program representation is then fed to a downstream network – a bidirectional long–short term memory architecture – to predict if the target code contains a vulnerability or not. We apply Developer to identify vulnerabilities at the program source-code level. Our evaluation shows that Developer outperforms state-of-the-art methods by uncovering more vulnerabilities with a lower false-positive rate.

Detecting code vulnerabilities by learning from large-scale open source repositories

Automated software vulnerability detection with machine learning

Survey of Source Code Vulnerability Analysis Based on Deep Learning

Transformer-based Vulnerability Detection in Code at EditTime: Zero-shot, Few-shot, or Fine-tuning?

DiverseVul: A New Vulnerable Source Code Dataset for Deep Learning Based Vulnerability Detection

DeepVulSeeker: A novel vulnerability identification framework via code graph structure and pre-training mechanism

An Empirical Evaluation of Deep Learning‐based Source Code Vulnerability Detection: Representation Versus Models

VulD-SG: Enhancing Code Vulnerability Detection Via Combining Deep Sequence and Graph Model

DeepVuler: A Vulnerability Intelligence Mining System for Open-Source Communities

Outside the Comfort Zone: Analysing LLM Capabilities in Software Vulnerability Detection

Efficient Vulnerability Detection Based On Abstract Syntax Tree And Deep Learning

DeepWukong

Enhancing Code Vulnerability Detection via Vulnerability-Preserving Data Augmentation

Systematic Analysis of Deep Learning Model for Vulnerable Code Detection

Software Vulnerability Mining and Analysis Based on Deep Learning

Vulnerability Detection in C/C++ Code with Deep Learning

Automated Vulnerability Detection in Source Code Using Minimum Intermediate Representation Learning

Combining Graph-Based Learning With Automated Data Collection for Code Vulnerability Detection

Machine-learning supported vulnerability detection in source code