On using distributed representations of source code for the detection of C security vulnerabilities
arXiv:2106.01367
Abstract
This paper presents an evaluation of the code representation model Code2vec when trained on the task of detecting security vulnerabilities in C source code. We leverage the open-source library astminer to extract path-contexts from the abstract syntax trees of a corpus of labeled C functions. Code2vec is trained on the resulting path-contexts with the task of classifying a function as vulnerable or non-vulnerable. Using the CodeXGLUE benchmark, we show that the accuracy of Code2vec for this task is comparable to simple transformer-based methods such as pre-trained RoBERTa, and outperforms more naive NLP-based methods. We achieved an accuracy of 61.43% while maintaining low computational requirements relative to larger models.
arXiv commentSubmitted to DX 2021
References in corpus (6)
- CodeXGLUE: A Machine Learning Benchmark Dataset for Code Understanding and Generation
- CodeBERT: A Pre-Trained Model for Programming and Natural Languages
- Devign: Effective Vulnerability Identification by Learning Comprehensive Program Semantics via Graph Neural Networks
- Automated software vulnerability detection with machine learning
- Exploring Software Naturalness through Neural Language Models
- Low-Memory Neural Network Training: A Technical Report