Abstract:Software vulnerability detection is critical in software security because it identifies potential bugs in software systems, enabling immediate remediation and mitigation measures to be implemented before they may be exploited. Automatic vulnerability identification is important because it can evaluate large codebases more efficiently than manual code auditing. Many Machine Learning (ML) and Deep Learning (DL) based models for detecting vulnerabilities in source code have been presented in recent years. However, a survey that summarises, classifies, and analyses the application of ML/DL models for vulnerability detection is missing. It may be difficult to discover gaps in existing research and potential for future improvement without a comprehensive survey. This could result in essential areas of research being overlooked or under-represented, leading to a skewed understanding of the state of the art in vulnerability detection. This work address that gap by presenting a systematic survey to characterize various features of ML/DL-based source code level software vulnerability detection approaches via five primary research questions (RQs). Specifically, our RQ1 examines the trend of publications that leverage ML/DL for vulnerability detection, including the evolution of research and the distribution of publication venues. RQ2 describes vulnerability datasets used by existing ML/DL-based models, including their sources, types, and representations, as well as analyses of the embedding techniques used by these approaches. RQ3 explores the model architectures and design assumptions of ML/DL-based vulnerability detection approaches. RQ4 summarises the type and frequency of vulnerabilities that are covered by existing studies. Lastly, RQ5 presents a list of current challenges to be researched and an outline of a potential research roadmap that highlights crucial opportunities for future work.

Machine Learning-Powered Identification of Source Code Vulnerabilities

Automated software vulnerability detection with machine learning

A Survey on Machine Learning Techniques for Source Code Analysis

Machine Learning Techniques for Python Source Code Vulnerability Detection

Machine-learning supported vulnerability detection in source code

Survey of Source Code Vulnerability Analysis Based on Deep Learning

Representation vs. Model: What Matters Most for Source Code Vulnerability Detection

Harnessing the Power of LLMs in Source Code Vulnerability Detection

Code2Image: Intelligent Code Analysis by Computer Vision Techniques and Application to Vulnerability Prediction

On the Use of Fine-grained Vulnerable Code Statements for Software Vulnerability Assessment Models

A Survey on Automated Software Vulnerability Detection Using Machine Learning and Deep Learning

Systematic Analysis of Deep Learning Model for Vulnerable Code Detection

Automated Code-centric Software Vulnerability Assessment: How Far Are We? An Empirical Study in C/C++

Estimating defectiveness of source code: A predictive model using GitHub content

Transformer-based Vulnerability Detection in Code at EditTime: Zero-shot, Few-shot, or Fine-tuning?

Software Vulnerability Mining and Analysis Based on Deep Learning

Detecting code vulnerabilities by learning from large-scale open source repositories

Deep Learning-Based Out-of-distribution Source Code Data Identification: How Far Have We Gone?

Outside the Comfort Zone: Analysing LLM Capabilities in Software Vulnerability Detection

Source Code Vulnerability Detection: Combining Code Language Models and Code Property Graphs

Uncovering the Limits of Machine Learning for Automatic Vulnerability Detection