Abstract
Automated vulnerability detection is one of the critical issues in the realm of software security. Existing solutions to this problem are mostly based on features that are defined by human experts and directly lead to missed potential vulnerability. Deep learning is an effective method for automating the extraction of vulnerability characteristics. Our paper proposes intelligent and automated vulnerability detection while using deep representation learning and heterogeneous ensemble learning. Firstly, we transform sample data from source code by removing segments that are unrelated to the vulnerability in order to reduce code analysis and improve detection efficiency in our experiments. Secondly, we represent the sample data as real vectors by pre-training on the corpus and maintaining its semantic information. Thirdly, the vectors are fed to a deep learning model to obtain the features of vulnerability. Lastly, we train a heterogeneous ensemble classifier. We analyze the effectiveness and resource consumption of different network models, pre-training methods, classifiers, and vulnerabilities separately in order to evaluate the detection method. We also compare our approach with some well-known vulnerability detection commercial tools and academic methods. The experimental results show that our proposed method provides improvements in false positive rate, false negative rate, precision, recall, and F1 score.
Highlights
Software vulnerabilities are one of the root causes of cybersecurity issues
According to the false rate (FPR + False negative rate (FNR)), P, R, and F1, we found that trainable embedding is better than static embedding because the fine-tuning can be adjusted to each work
We researched vulnerability detection methods related to deep learning
Summary
Software vulnerabilities are one of the root causes of cybersecurity issues. Despite the improving software quality in academia and industry, new vulnerabilities have been exposed, causing huge losses.A large number of vulnerabilities were proven by Common Vulnerabilities and Exposures [1].Vulnerability detection is an effective method for discovering software bugs. Software vulnerabilities are one of the root causes of cybersecurity issues. Despite the improving software quality in academia and industry, new vulnerabilities have been exposed, causing huge losses. A large number of vulnerabilities were proven by Common Vulnerabilities and Exposures [1]. Vulnerability detection is an effective method for discovering software bugs. Vulnerability detection methods can be categorized as static and dynamic methods. High coverage and low false positives are the advantages of static methods and dynamic methods, respectively. Many studies of source-code-based static analysis during the software development stage considered open-source tools [2,3,4], commercial tools [5,6,7], and academic research tools [8,9,10] to reduce dynamic runtime costs
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have