Detecting software vulnerabilities using deep learning

Abstract

Developing software projects successful is always a top concern for organizations and enterprises.  Among these concerns, ensuring software quality is the highest priority throughout the entire development and operation process. This paper addresses the detection of source code vulnerabilities and focuses on analyzing the syntax and semantics of statements within the source code. The source code vulnerability detection model follows a structured process: (i) syntactic and semantic representation; 
(ii) feature extraction from source code; (iii) data balancing; and (iv) source code classification. The 
model’s output indicates whether the source code is normal or contains vulnerabilities. The model istrained using the SARD dataset and incorporates deep learning approaches. Specifically, it employs 
the BERT (Bidirectional Encoder Representations from Transformers) model, the Word2Vec 
model combined with LSTM (Long Short-Term Memory), and the Word2Vec model with BiLSTM 
(Bidirectional Long Short-Term Memory) across three scenarios. Classification results are passed 
through a softmax function to generate a vector containing the probability predictions for each type 
of vulnerability. The detection model achieves an accuracy rate of up to 82.63% for identifying source 
code vulnerabilities, with a corresponding omission rate of only 17.37%. This result is considered 
acceptable and demonstrates the superior effectiveness of the approach in the task of source code 
vulnerability detection.