SySeVR: A Framework for Using Deep Learning to Detect Software Vulnerabilities

Abstract

The detection of software vulnerabilities (or vulnerabilities for short) is an important problem that has yet to be tackled, as manifested by the many vulnerabilities reported on a daily basis. This calls for machine learning methods for vulnerability detection. Deep learning is attractive for this purpose because it alleviates the requirement to manually define features. Despite the tremendous success of deep learning in other application domains, its applicability to vulnerability detection is not systematically understood. In order to fill this void, we propose the first systematic framework for using deep learning to detect vulnerabilities in C/C++ programs with source code. The framework, dubbed Syntax-based, Semantics-based, and Vector Representations (SySeVR), focuses on obtaining program representations that can accommodate syntax and semantic information pertinent to vulnerabilities. Our experiments with 4 software products demonstrate the usefulness of the framework: we detect 15 vulnerabilities that are not reported in the National Vulnerability Database. Among these 15 vulnerabilities, 7 are unknown and have been reported to the vendors, and the other 8 have been "silently" patched by the vendors when releasing newer versions of the pertinent software products.

To be published in IEEE TDSC

References in corpus (3)

• VulDeePecker: A Deep Learning-Based System for Vulnerability Detection
• Semantically Enhanced Software Traceability Using Deep Learning Techniques
• $\mu$VulDeePecker: A Deep Learning-Based System for Multiclass Vulnerability Detection

Cited by in corpus (18)

• VulDeeLocator: A Deep Learning-based Fine-grained Vulnerability Detector
• VulBERTa: Simplified Source Code Pre-Training for Vulnerability Detection
• Large Language Models for Code: Security Hardening and Adversarial Testing
• Vul-LMGNNs: Fusing language models and online-distilled graph neural networks for code vulnerability detection
• A Survey of Source Code Representations for Machine Learning-Based Cybersecurity Tasks
• Toward Improved Deep Learning-based Vulnerability Detection
• A comparative study of neural network techniques for automatic software vulnerability detection
• Beyond Fidelity: Explaining Vulnerability Localization of Learning-based Detectors
• Data Quality Issues in Vulnerability Detection Datasets
• An Unbiased Transformer Source Code Learning with Semantic Vulnerability Graph
• Ranking Warnings of Static Analysis Tools Using Representation Learning
• Semantic-Enhanced Indirect Call Analysis with Large Language Models
• Automated Code-centric Software Vulnerability Assessment: How Far Are We? An Empirical Study in C/C++
• An Empirical Study of the Imbalance Issue in Software Vulnerability Detection
• Multi-modal Learning for WebAssembly Reverse Engineering
• Are We Learning the Right Features? A Framework for Evaluating DL-Based Software Vulnerability Detection Solutions
• Similar but Patched Code Considered Harmful -- The Impact of Similar but Patched Code on Recurring Vulnerability Detection and How to Remove Them
• LLaVul: A Multimodal LLM for Interpretable Vulnerability Reasoning about Source Code