Vulnerability Detection Via Deep Learning Scholar John Heaps

Vulnerability Detection Via Deep Learning Scholar: John Heaps Advisor: Dr. Jianwei Niu

Vulnerability Detection in Static Analysis ● Static analysis is one of the most popular techniques for code analysis and vulnerability detection ● Static analysis limitations: ○ ○ ○ Requires specifications/patterns/rules to be provided for it Usually very conservative Not always scalable ● We believe deep learning can help overcome some of these limitations

Vulnerability Detection Using Deep Learning ● Goal: Given a segment of code, the code elements will be fed into a deep learning classifier that will determine if the code has a vulnerability or not ● To use deep learning on code, we take motivation from deep learning on natural language ○ Hindle, Abram, et al. "On the naturalness of software. " 2012 34 th International Conference on Software Engineering (ICSE). IEEE, 2012. ● Deep learning algorithms do not understand text, only numbers ○ So code elements must first be converted to a real-valued vector representation (called “word embeddings”)

Current Research Problems ● How to construct proper word embeddings for source code? ○ ○ Syntax and structure of code is much more complex than natural language How to best represent certain code elements, such as methods, expressions, data structures, etc. ? ● We know of no robust, annotated dataset for code vulnerabilities for our deep learning model to learn on