{"id":34114,"date":"2022-01-26T11:13:20","date_gmt":"2022-01-26T10:13:20","guid":{"rendered":"https:\/\/www.inovex.de\/?p=34114"},"modified":"2025-02-26T08:02:11","modified_gmt":"2025-02-26T07:02:11","slug":"how-to-detect-software-vulnerabilities-in-source-code-using-machine-learning","status":"publish","type":"post","link":"https:\/\/www.inovex.de\/de\/blog\/how-to-detect-software-vulnerabilities-in-source-code-using-machine-learning\/","title":{"rendered":"How to Detect Software Vulnerabilities in Source Code Using Machine Learning"},"content":{"rendered":"

This article examines the application of Machine Learning models to predict software vulnerabilities in source code based on its graph representation. For this purpose, two different approaches are used for learning graph embeddings of source code in the context of an \u200b\u200bappropriate classification to distinguish vulnerable and non-vulnerable code samples. The first approach is based on graph2vec followed by a Multilayer Perceptron, while the second approach involves the use of Graph Neural Networks. We compare both approaches on the Draper VDISC dataset.<\/p>\n

<\/p>\n

Developing software systems is costly as software engineers have to handle the complexity of software development and deliver highly functional software products on schedule while at the same time avoiding bugs and vulnerabilities. A software vulnerability is a fault or weakness in the design, implementation or operation of software that can be exploited by a threat actor, such as a hacker, to perform unauthorized actions on a system [1]. Different analysis techniques are applied to detect vulnerabilities in source code during development, such as static and dynamic analyzers [2]. However, both static and dynamic analyzers are rule-based tools and thus limited to their hand-engineered rules [3]. Moreover, these tools cannot handle incomplete or incorrect information very well \u2013 data that does not have an associated rule will be ignored [4]. The use of Machine Learning (ML) is the key to the intelligent analysis of huge amounts of data and the development of the corresponding intelligent and automated applications. A useful property of several ML systems is that they can detect „hidden“ features that are not obvious to a human to include in a rule-based tool [5]. This in turn has opened the door for many different contributions in the field of software vulnerability analysis and detection using ML [6].<\/p>\n

\n

<\/p>\n<\/div>