Multi-context Attention Fusion Neural Network for Software Vulnerability Identification
This work addresses software security for developers and companies by enabling efficient and explainable vulnerability detection before code release, though it appears incremental as it builds on existing methods for a known bottleneck.
The paper tackles the problem of detecting security vulnerabilities in source code by proposing a deep learning model that combines recurrent, convolutional, and self-attention networks to identify and localize vulnerabilities, achieving a 98.40% F1-score on specific CWEs from the NIST SARD dataset.
Security issues in shipped code can lead to unforeseen device malfunction, system crashes or malicious exploitation by crackers, post-deployment. These vulnerabilities incur a cost of repair and foremost risk the credibility of the company. It is rewarding when these issues are detected and fixed well ahead of time, before release. Common Weakness Estimation (CWE) is a nomenclature describing general vulnerability patterns observed in C code. In this work, we propose a deep learning model that learns to detect some of the common categories of security vulnerabilities in source code efficiently. The AI architecture is an Attention Fusion model, that combines the effectiveness of recurrent, convolutional and self-attention networks towards decoding the vulnerability hotspots in code. Utilizing the code AST structure, our model builds an accurate understanding of code semantics with a lot less learnable parameters. Besides a novel way of efficiently detecting code vulnerability, an additional novelty in this model is to exactly point to the code sections, which were deemed vulnerable by the model. Thus helping a developer to quickly focus on the vulnerable code sections; and this becomes the "explainable" part of the vulnerability detection. The proposed AI achieves 98.40% F1-score on specific CWEs from the benchmarked NIST SARD dataset and compares well with state of the art.