Automated vulnerability detection in software applications using AI

This paper investigates into the application of artificial intelligence (AI) for automation of identification process of vulnerabilities in software applications. More sophisticated approaches are required since older ones like manual reviews and static analyzer can not scale or are precise enough. Our goal is to, with the help of machine and deep learning (ML/DL), especially latest transformer models like BERT etc., enhance the efficiency and generate powerful estimates for vulnerability detection. The experiment is based on large, annotated datasets harvested from public repositories and enriched with synthetic data produced through code mutation algorithms. Our approach consists of deep-learning model training that takes preprocessed data with tokenization and normalization as input while being executed on HPC systems. Performance of the models is evaluated using different metrics including accuracy, precision, recall and F1. The results are much better than the traditional algorithms, and transformer models perform best. Importantly, the work also evidences the importance of augmented data and robust model evaluation. Notwithstanding its seemingly successful results, there exist some challenges associated with data paucity and computational burden. This work demonstrates the opportunity of AI for software security improvement and a stepping stone toward new achievements in automatic vulnerability discovery.