# Multi-context Attention Fusion Neural Network for Software Vulnerability Identification

arXiv: https://arxiv.org/abs/2104.09225 · HTML: https://mlsanity.com/paper/2104.09225/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 3 of its 22 references that are in the map.
- First posted on arXiv 19 Apr 2021.

## Builds on (most cited first, 3 of 3)

- [Devign: Effective Vulnerability Identification by Learning Comprehensive Program Semantics via Graph Neural Networks](https://mlsanity.com/paper/1909.03496/) (2019)
- [SySeVR: A Framework for Using Deep Learning to Detect Software Vulnerabilities](https://mlsanity.com/paper/1807.06756/) (2018)
- [Automated software vulnerability detection with machine learning](https://mlsanity.com/paper/1803.04497/) (2018)

## Built on by (most cited first, 3 of 3)

- [FastPacket: Towards Pre-trained Packets Embedding based on FastText for next-generation NIDS](https://mlsanity.com/paper/2209.14727/) (2022)
- [An experimental study in Real-time Facial Emotion Recognition on new 3RL dataset](https://mlsanity.com/paper/2304.03064/) (2023)
- [Vulnerability Detection Using Two-Stage Deep Learning Models](https://mlsanity.com/paper/2305.09673/) (2023)

## Abstract (arXiv)

Security issues in shipped code can lead to unforeseen device malfunction, system crashes or malicious exploitation by crackers, post-deployment. These vulnerabilities incur a cost of repair and foremost risk the credibility of the company. It is rewarding when these issues are detected and fixed well ahead of time, before release. Common Weakness Estimation (CWE) is a nomenclature describing general vulnerability patterns observed in C code. In this work, we propose a deep learning model that learns to detect some of the common categories of security vulnerabilities in source code efficiently. The AI architecture is an Attention Fusion model, that combines the effectiveness of recurrent, convolutional and self-attention networks towards decoding the vulnerability hotspots in code. Utilizing the code AST structure, our model builds an accurate understanding of code semantics with a lot less learnable parameters. Besides a novel way of efficiently detecting code vulnerability, an additional novelty in this model is to exactly point to the code sections, which were deemed vulnerable by the model. Thus helping a developer to quickly focus on the vulnerable code sections; and this becomes the "explainable" part of the vulnerability detection. The proposed AI achieves 98.40% F1-score on specific CWEs from the benchmarked NIST SARD dataset and compares well with state of the art.