# Automated software vulnerability detection with machine learning

arXiv: https://arxiv.org/abs/1803.04497 · HTML: https://mlsanity.com/paper/1803.04497/

## Key facts

- Cited by 34 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 14 Feb 2018.

## Built on by (most cited first, 30 of 34)

- [A Closer Look at AUROC and AUPRC under Class Imbalance](https://mlsanity.com/paper/2401.06091/) (2024)
- [PalmTree: Learning an Assembly Language Model for Instruction Embedding](https://mlsanity.com/paper/2103.03809/) (2021)
- [An Exploratory Study on Code Attention in BERT](https://mlsanity.com/paper/2204.10200/) (2022)
- [VarCLR: Variable Semantic Representation Pre-training via Contrastive Learning](https://mlsanity.com/paper/2112.02650/) (2021)
- [ChatNVD: Advancing Cybersecurity Vulnerability Assessment with Large Language Models](https://mlsanity.com/paper/2412.04756/) (2024)
- [On using distributed representations of source code for the detection of C security vulnerabilities](https://mlsanity.com/paper/2106.01367/) (2021)
- [LLMSecConfig: An LLM-Based Approach for Fixing Software Container Misconfigurations](https://mlsanity.com/paper/2502.02009/) (2025)
- [A Survey of Large Language Models in Cybersecurity](https://mlsanity.com/paper/2402.16968/) (2024)
- [SV-TrustEval-C: Evaluating Structure and Semantic Reasoning in Large Language Models for Source Code Vulnerability Analysis](https://mlsanity.com/paper/2505.20630/) (2025)
- [Multi-View Graph Representation for Programming Language Processing: An Investigation into Algorithm Detection](https://mlsanity.com/paper/2202.12481/) (2022)
- [Exploiting Method Names to Improve Code Summarization: A Deliberation Multi-Task Learning Approach](https://mlsanity.com/paper/2103.11448/) (2021)
- [Software Vulnerability Detection via Deep Learning over Disaggregated Code Graph Representation](https://mlsanity.com/paper/2109.03341/) (2021)
- [A Survey of Source Code Representations for Machine Learning-Based Cybersecurity Tasks](https://mlsanity.com/paper/2403.10646/) (2024)
- [Learning to Make Compiler Optimizations More Effective](https://mlsanity.com/paper/2102.13514/) (2021)
- [CodeGRAG: Bridging the Gap between Natural Language and Programming Language via Graphical Retrieval Augmented Generation](https://mlsanity.com/paper/2405.02355/) (2024)
- [Multi-context Attention Fusion Neural Network for Software Vulnerability Identification](https://mlsanity.com/paper/2104.09225/) (2021)
- [Test2Vec: An Execution Trace Embedding for Test Case Prioritization](https://mlsanity.com/paper/2206.15428/) (2022)
- [VULPO: Context-Aware Vulnerability Detection via On-Policy LLM Optimization](https://mlsanity.com/paper/2511.11896/) (2025)
- [A comparative study of neural network techniques for automatic software vulnerability detection](https://mlsanity.com/paper/2104.14978/) (2021)
- [HyMo: Vulnerability Detection in Smart Contracts using a Novel Multi-Modal Hybrid Model](https://mlsanity.com/paper/2304.13103/) (2023)
- [Dynamic Neural Control Flow Execution: An Agent-Based Deep Equilibrium Approach for Binary Vulnerability Detection](https://mlsanity.com/paper/2404.08562/) (2024)
- [Social Media Monitoring for IoT Cyber-Threats](https://mlsanity.com/paper/2109.04306/) (2021)
- [LAMNER: Code Comment Generation Using Character Language Model and Named Entity Recognition](https://mlsanity.com/paper/2204.09654/) (2022)
- [DCDetector: An IoT terminal vulnerability mining system based on distributed deep ensemble learning under source code representation](https://mlsanity.com/paper/2211.16235/) (2022)
- [Enhancing Source Code Classification Effectiveness via Prompt Learning Incorporating Knowledge Features](https://mlsanity.com/paper/2401.05544/) (2024)
- [Embedding Code Contexts for Cryptographic API Suggestion:New Methodologies and Comparisons](https://mlsanity.com/paper/2103.08747/) (2021)
- [Featherweight Assisted Vulnerability Discovery](https://mlsanity.com/paper/2202.02679/) (2022)
- [A Structural Approach to the Design of Domain Specific Neural Network Architectures](https://mlsanity.com/paper/2301.09381/) (2023)
- [Sequential Graph Neural Networks for Source Code Vulnerability Identification](https://mlsanity.com/paper/2306.05375/) (2023)
- [Feature Engineering-Based Detection of Buffer Overflow Vulnerability in Source Code Using Neural Networks](https://mlsanity.com/paper/2306.07981/) (2023)

## Abstract (arXiv)

Thousands of security vulnerabilities are discovered in production software each year, either reported publicly to the Common Vulnerabilities and Exposures database or discovered internally in proprietary code. Vulnerabilities often manifest themselves in subtle ways that are not obvious to code reviewers or the developers themselves. With the wealth of open source code available for analysis, there is an opportunity to learn the patterns of bugs that can lead to security vulnerabilities directly from data. In this paper, we present a data-driven approach to vulnerability detection using machine learning, specifically applied to C and C++ programs. We first compile a large dataset of hundreds of thousands of open-source functions labeled with the outputs of a static analyzer. We then compare methods applied directly to source code with methods applied to artifacts extracted from the build process, finding that source-based models perform better. We also compare the application of deep neural network models with more traditional models such as random forests and find the best performance comes from combining features learned by deep models with tree-based models. Ultimately, our highest performing model achieves an area under the precision-recall curve of 0.49 and an area under the ROC curve of 0.87.