Identifying vulnerable code is a precautionary measure to counter software security breaches. Tedious expert effort has been spent to build static analyzers, yet insecure patterns are barely fully enumerated. This work explores a deep learning approach to automatically learn the insecure patterns from code corpora. Because code naturally admits graph structures with parsing, we develop a novel graph neural network (GNN) to exploit both the semantic context and structural regularity of a program, in order to improve prediction performance. Compared with a generic GNN, our enhancements include a synthesis of multiple representations learned from the several parsed graphs of a program, and a new training loss metric that leverages the fine granularity of labeling. Our model outperforms multiple text, image and graph-based approaches, across two real-world datasets.
VulDeePecker: A Deep Learning-Based System for Vulnerability Detection
Huazhong University of Science and Technology（华中科技大学）；Hebei University（河北大学）；Shenzhen Huazhong University of Science and Technology Research Institute（深圳华中科技大学研究院）；University of Texas at San Antonio（德克萨斯大学圣安东尼奥分校）
软件漏洞的自动检测是一个重要的研究课题。然而，该问题的现有解决方案依赖于人类专家来定义特征，并且经常错过许多漏洞（即，导致高假阴性率）。在本文中，我们开始研究使用基于深度学习的漏洞检测，以减轻人类专家手动定义特征的繁琐和主观任务。由于深度学习的动机是处理与漏洞检测问题非常不同的问题，因此我们需要一些将深度学习应用于漏洞检测的指导原则。特别是，我们需要找到适合深度学习的软件程序的表示。为此，我们建议使用代码小工具来表示程序，然后将它们转换为向量，其中代码小工具是一些（不一定是连续的）代码行，这些代码行在语义上彼此相关。这导致了一个基于深度学习的漏洞检测系统的设计和实现，称为Vulnerability Deep Pecker（VulDeepPecker）。为了评估VulDeePecker，我们为深度学习方法提供了第一个漏洞数据集。实验结果表明，VulDeePecker可以实现比其他方法少得多的假阴性（具有合理的假阳性）。我们进一步将VulDeePecker应用于3个软件产品（即Xen，Pionkey和Libav），并检测到4个漏洞，这些漏洞在国家漏洞数据库中没有报告，但在发布这些产品的后续版本时被供应商“默默”修补;相比之下，这些漏洞几乎完全被我们实验的其他漏洞检测系统所遗漏。
A Systematic Literature Review on Detecting Software Vulnerabilities with Large Language Models
Esslingen University（埃斯林根大学）；Institute for Intelligent Systems, Esslingen University（智能系统研究所，埃斯林根大学）；Chair of Communication Networks, University of Tübingen（通信网络教研室，图宾根大学）
Comparison of Static Application Security Testing Tools and Large Language Models for Repo-level Vulnerability Detection
Singapore Management University（新加坡管理大学）；Hanoi University of Science and Technology（河内理工大学）；The University of Melbourne（墨尔本大学）；University of Melbourne（墨尔本大学）
Harnessing Large Language Models for Software Vulnerability Detection: A Comprehensive Benchmarking Study
School of Information Technologies Tallinn University of Technology（塔林理工大学信息技术学院）；School of Informatics, Computing, and Cyber Systems Northern Arizona University（北亚利桑那大学信息学、计算与网络系统学院）
VulReaD: Knowledge-Graph-guided Software Vulnerability Reasoning and Detection
The University of Manchester（曼彻斯特大学）；Agency for Science, Technology and Research（科技研究局）；Singapore University of Technology and Design（新加坡科技设计大学）；Mohamed Bin Zayed University of Artificial Intelligence（穆罕默德·本·扎耶德人工智能大学）
Evaluating LLaMA 3.2 for Software Vulnerability Detection
Research Group on Intelligent Engineering and Computing for Advanced Innovation and Development (GECAD), School of Engineering of the Polytechnic of Porto（波尔图理工学院工程学院）；INESC TEC/Polytechnic of Porto - School of Engineering（INESC TEC/波尔图理工学院工程学院）
Agentic AI for Autonomous Defense in Software Supply Chain Security: Beyond Provenance to Vulnerability Mitigation
Faculty of Computer and Information System（计算机与信息系统学院）；Islamic University of Madinah（麦地那伊斯兰大学）；Faculty of Computer Studies（计算机研究学院）；Arab Open University-Bahrain（巴林阿拉伯开放大学）
