A deep learning‐based approach for software vulnerability detection using code metrics
Abstract Vulnerabilities can have devastating effects on information security, affecting the economy, social stability, and national security. The idea of automatic vulnerability detection has always attracted researchers. From traditional manual vulnerability mining techniques to static and dynamic...
Saved in:
| Main Authors: | , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Wiley
2022-10-01
|
| Series: | IET Software |
| Online Access: | https://doi.org/10.1049/sfw2.12066 |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1850166408217886720 |
|---|---|
| author | Fazli Subhan Xiaoxue Wu Lili Bo Xiaobing Sun Muhammad Rahman |
| author_facet | Fazli Subhan Xiaoxue Wu Lili Bo Xiaobing Sun Muhammad Rahman |
| author_sort | Fazli Subhan |
| collection | DOAJ |
| description | Abstract Vulnerabilities can have devastating effects on information security, affecting the economy, social stability, and national security. The idea of automatic vulnerability detection has always attracted researchers. From traditional manual vulnerability mining techniques to static and dynamic detection, all rely on human experts for feature definition. The rapid development of machine learning and deep learning has alleviated the tedious task of manually defining features by human experts while reducing the lack of objectivity caused by human subjective awareness. However, it is still necessary to find an objective characterisation method to define the features of vulnerabilities. Therefore, the authors use code metrics for code characterisation, sequences of metrics representing code. To use code metrics for vulnerability detection, a deep learning‐based vulnerability detection approach that uses a composite neural network of convolutional neural network (CNN) with long short‐term memory (LSTM) is proposed. The authors conduct experiments independently using the proposed approach for CNN‐LSTM CNN, LSTM, gated recurrent units (GRU), and deep neural network (DNN). The authors’ experimental results show that CNN‐LSTM has a high precision of 92%, a recall of 99%, and an accuracy of 91%. In terms of the F1‐score, it is 95%, compared to previous research results, which indicated an improvement of 18%. Compared to other deep learning‐based vulnerability detection models, the authors’ proposed model produced a lower false‐positive rate, a lower miss rate, and improved accuracy. |
| format | Article |
| id | doaj-art-e04b2d33932743a187e6c12e560d924c |
| institution | OA Journals |
| issn | 1751-8806 1751-8814 |
| language | English |
| publishDate | 2022-10-01 |
| publisher | Wiley |
| record_format | Article |
| series | IET Software |
| spelling | doaj-art-e04b2d33932743a187e6c12e560d924c2025-08-20T02:21:28ZengWileyIET Software1751-88061751-88142022-10-0116551652610.1049/sfw2.12066A deep learning‐based approach for software vulnerability detection using code metricsFazli Subhan0Xiaoxue Wu1Lili Bo2Xiaobing Sun3Muhammad Rahman4College of Information Engineering Yangzhou University Jiangsu Yangzhou Jiangsu ChinaCollege of Information Engineering Yangzhou University Jiangsu Yangzhou Jiangsu ChinaCollege of Information Engineering Yangzhou University Jiangsu Yangzhou Jiangsu ChinaCollege of Information Engineering Yangzhou University Jiangsu Yangzhou Jiangsu ChinaCollege of Information Engineering Yangzhou University Jiangsu Yangzhou Jiangsu ChinaAbstract Vulnerabilities can have devastating effects on information security, affecting the economy, social stability, and national security. The idea of automatic vulnerability detection has always attracted researchers. From traditional manual vulnerability mining techniques to static and dynamic detection, all rely on human experts for feature definition. The rapid development of machine learning and deep learning has alleviated the tedious task of manually defining features by human experts while reducing the lack of objectivity caused by human subjective awareness. However, it is still necessary to find an objective characterisation method to define the features of vulnerabilities. Therefore, the authors use code metrics for code characterisation, sequences of metrics representing code. To use code metrics for vulnerability detection, a deep learning‐based vulnerability detection approach that uses a composite neural network of convolutional neural network (CNN) with long short‐term memory (LSTM) is proposed. The authors conduct experiments independently using the proposed approach for CNN‐LSTM CNN, LSTM, gated recurrent units (GRU), and deep neural network (DNN). The authors’ experimental results show that CNN‐LSTM has a high precision of 92%, a recall of 99%, and an accuracy of 91%. In terms of the F1‐score, it is 95%, compared to previous research results, which indicated an improvement of 18%. Compared to other deep learning‐based vulnerability detection models, the authors’ proposed model produced a lower false‐positive rate, a lower miss rate, and improved accuracy.https://doi.org/10.1049/sfw2.12066 |
| spellingShingle | Fazli Subhan Xiaoxue Wu Lili Bo Xiaobing Sun Muhammad Rahman A deep learning‐based approach for software vulnerability detection using code metrics IET Software |
| title | A deep learning‐based approach for software vulnerability detection using code metrics |
| title_full | A deep learning‐based approach for software vulnerability detection using code metrics |
| title_fullStr | A deep learning‐based approach for software vulnerability detection using code metrics |
| title_full_unstemmed | A deep learning‐based approach for software vulnerability detection using code metrics |
| title_short | A deep learning‐based approach for software vulnerability detection using code metrics |
| title_sort | deep learning based approach for software vulnerability detection using code metrics |
| url | https://doi.org/10.1049/sfw2.12066 |
| work_keys_str_mv | AT fazlisubhan adeeplearningbasedapproachforsoftwarevulnerabilitydetectionusingcodemetrics AT xiaoxuewu adeeplearningbasedapproachforsoftwarevulnerabilitydetectionusingcodemetrics AT lilibo adeeplearningbasedapproachforsoftwarevulnerabilitydetectionusingcodemetrics AT xiaobingsun adeeplearningbasedapproachforsoftwarevulnerabilitydetectionusingcodemetrics AT muhammadrahman adeeplearningbasedapproachforsoftwarevulnerabilitydetectionusingcodemetrics AT fazlisubhan deeplearningbasedapproachforsoftwarevulnerabilitydetectionusingcodemetrics AT xiaoxuewu deeplearningbasedapproachforsoftwarevulnerabilitydetectionusingcodemetrics AT lilibo deeplearningbasedapproachforsoftwarevulnerabilitydetectionusingcodemetrics AT xiaobingsun deeplearningbasedapproachforsoftwarevulnerabilitydetectionusingcodemetrics AT muhammadrahman deeplearningbasedapproachforsoftwarevulnerabilitydetectionusingcodemetrics |