Abstract:Context: Desirable characteristics in vulnerability-detection (VD) systems (VDSs) include both good detection capability (high accuracy, low false positive rate, low false negative rate, etc.) and low time overheads. The widely used VDSs based on models such as Recurrent Neural Networks (RNNs) have some problems, such as low time efficiency, failing to learn the vulnerability features better, and insufficent amounts of vulnerability features. Therefore, it is very important to construct an automatic detection model with high detection accuracy. Objective: This paper reports on training based on the source code to analyze and learn from the code's patterns and structures by deep-learning techniques to generate an efficient VD model that does not require manual feature design. Method: We propose a software VD model based on multi-feature fusion and deep neural networks called AIdetectorX-SP. It first uses a Temporal Convolutional Network (TCN) and adds a Self-attention Mechanism (SaM) to the TCN to build a model for extracting vulnerability logic features, then transforms the source code into an image input to a Convolutional Neural Network (CNN) to extract structural and semantic information. Finally, we use feature-fusion technology to design and implement an improved deep-learning-based VDS, called AIdetectorX Sequence with Picturization (AIdetectorX-SP). Results: We report on experiments conducted using publicly-available and widely-used datasets to evaluate the effectiveness of AIdetectorX-SP, with results indicating that AIdetectorX-SP is an effective VDS; that the combination of TCN and SaM can effectively extract vulnerability logic features; and that the pictorial code can extract code structure features, which can further improve the VD capability. Conclusion: In this paper, we propose a novel detection model for software vulnerability based on TCNs, SaM, and software picturization. The proposed model solves some shortcomings and limitations of existing VDSs, and obtains a high software-VD accuracy with a high degree of stability.

Automated Vulnerability Detection in Source Code Using Minimum Intermediate Representation Learning

Function-Level Vulnerability Detection Through Fusing Multi-Modal Knowledge

Ignnvd: A Novel Software Vulnerability Detection Model Based on Integrated Graph Neural Networks

Automated software vulnerability detection with machine learning

HGVul: A Code Vulnerability Detection Method Based on Heterogeneous Source-Level Intermediate Representation

Vulnerability Detection for Source Code Using Contextual LSTM

Representation vs. Model: What Matters Most for Source Code Vulnerability Detection

An Automatic Source Code Vulnerability Detection Approach Based on KELM

A Comparative Study of Deep Learning-Based Vulnerability Detection System

Survey of Source Code Vulnerability Analysis Based on Deep Learning

Vulnerability Detection with Representation Learning.

Deep-Learning-based Vulnerability Detection in Binary Executables

Software Vulnerability Mining and Analysis Based on Deep Learning

Detecting code vulnerabilities by learning from large-scale open source repositories

Transformer-based Vulnerability Detection in Code at EditTime: Zero-shot, Few-shot, or Fine-tuning?

Hybrid semantics-based vulnerability detection incorporating a Temporal Convolutional Network and Self-attention Mechanism

Software vulnerable functions discovery based on code composite feature

Explaining the Contributing Factors for Vulnerability Detection in Machine Learning

Vulnerability Detection in C/C++ Code with Deep Learning

A novel approach for software vulnerability detection based on intelligent cognitive computing