SFN: A Novel Scalable Feature Network for Vulnerability Representation of Open-Source Codes

Area of Science:

• Software Engineering
• Computer Science
• Cybersecurity

Background:

• Vulnerability detection is crucial for software security.
• Current methods often suffer from information loss due to incomplete code characterization.
• There is a need for more comprehensive source code analysis techniques.

Purpose of the Study:

• To propose a novel composite feature extraction method for source code.
• To enhance the comprehensiveness of source code characterization.
• To develop an effective model for scalable vulnerability detection.

Main Methods:

• Developed a Scalable Feature Network (SFN) using Continuous Bag of Words and Convolutional Neural Networks.
• Constructed multiscale code metrics at semantic, line, and function granularities.
• Integrated SFN with Bi-LSTM to create the Scalable Vulnerability Detection Model (SVDM).

Main Results:

• The SVDM achieved a precision of over 84.3% and a recall of 83.4%.
• False Negative Rate (FNR) and False Positive Rate (FPR) were both kept below 17%.
• The proposed method demonstrates superior performance in vulnerability detection.

Conclusions:

• The Scalable Feature Network (SFN) effectively addresses information loss in code characterization.
• The Scalable Vulnerability Detection Model (SVDM) offers a promising approach for accurate and scalable software vulnerability detection.
• The multiscale code metrics contribute to a more comprehensive analysis of source code.