SySeVR: A Framework for Using Deep Learning to Detect Software Vulnerabilities

By Z. Li, Deqing Zou, Shouhuai Xu, Hai Jin, Yawei Zhu, Zhaoxuan Chen, Sujuan Wang, Jialai Wang. IEEE Transactions on Dependable and Secure Computing, 2018

781 citations recorded by the source corpus.

The detection of software vulnerabilities (or vulnerabilities for short) is an important problem that has yet to be tackled, as manifested by the many vulnerabilities reported on a daily basis. This calls for machine learning methods for vulnerability detection. Deep learning is attractive for this purpose because it alleviates the requirement to manually define features. Despite the tremendous success of deep learning in other application domains, its applicability to vulnerability detection is not systematically understood. In order to fill this void, we propose the first systematic framework for using deep learning to detect vulnerabilities in C/C++ programs with source code. The framework, dubbed Syntax-based, Semantics-based, and Vector Representations (SySeVR), focuses on obtaining program representations that can accommodate syntax and semantic information pertinent to vulnerabilities. Our experiments with four software products demonstrate the usefulness of the framework: we detect 15 vulnerabilities that are not reported in the National Vulnerability Database. Among these 15 vulnerabilities, seven are unknown and have been reported to the vendors, and the other eight have been “silently” patched by the vendors when releasing newer versions of the pertinent software products.

Subfields: Information Systems

View Paper: https://www.semanticscholar.org/paper/cb7f45a0915bfc833f36523b22bd12bab766d8a8

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

Citations in the corpus

Deep Learning Based Vulnerability Detection: Are We There Yet? (2020, methodology): “VulDeePecker [3] and SySeVR [4] uses Word2Vec to transform their symbolic tokens into vectors.”
NoFunEval: Funny How Code LMs Falter on Requirements Beyond Functional Correctness (2024, methodology): “…works have considered code-comprehension tasks like Clone-detection (Svajlenko et al., 2014; Lu et al., 2021), Defect-detection (Zhou et al., 2019; Li et al., 2021; Lu et al., 2021), Code-explaination (Muennighoff et al., 2023; Leinonen et al., 2023), and Question Answering over Code (Huang et…”
LineVul: A Transformer-based Line-Level Vulnerability Prediction (2022, methodology): “To answer this RQ, we focus on the function-level vulnerability predictions and compare our LineVul with the other seven baseline models described as follows: (1) IVDetect [30] leverages Feature-Attention Graph Convolu-tional Network (GCN) for vulnerability predictions using five types of feature re”
Software Vulnerability Detection Using Deep Neural Networks: A Survey (2020, methodology): “Studies provide data sets in a relatively large size, which may require the usage of a commercial tool [55], [56], [127].”
Vulnerability detection with fine-grained interpretations (2021, methodology): “For the method-level VD, our results show that IVDetect outperforms the existing ML/DL-based approaches [11, 19, 20, 27, 37] by 43%–84% and 105%–255% at the top 10 list for two ranking scores nDCG and MAP, respectively.”
DiverseVul: A New Vulnerable Source Code Dataset for Deep Learning Based Vulnerability Detection (2023, methodology): “DL for Vulnerable Source Code Detection: Previous papers have used LSTM [14], CNNs and RNNs [24], Bidirectional RNNS [13], and Graph Neural Networks [4, 17, 31] to detect vulnerable source code.”