Detecting software vulnerabilities using deep learning

Abstract

Developing successful of software projects is always a top concern for organizations and enterprises. Among these concerns, ensuring software quality is the highest priority throughout the entire development and operation process. This paper addresses the detection of source code vulnerabilities and focuses on analyzing the syntax and semantics of statements within the source code. The source code vulnerability detection model follows a structured process: (i) syntactic and semantic representation; (ii) feature extraction from source code; (iii) data balancing; and (iv) source code classification. The model's output indicates whether the source code is normal or contains vulnerabilities. The model is trained using the SART dataset and incorporates deep learning approaches. Specifically, it employs the BERT model, the Word2Vec model combined with LSTM, and the Word2Vec model with BiLSTM across three scenarios. Classification results are passed through a softmax function to generate a vector containing the probability predictions for each type of vulnerability. The detection model achieves an accuracy rate of up to 82.63% for identifying source code vulnerabilities, with a corresponding omission rate of only 17.37%. This result is considered acceptable and demonstrates the superior effectiveness of the approach in the task of source code vulnerability detection