# A Hierarchical Deep Neural Network for Detecting Lines of Codes with Vulnerabilities

arXiv: https://arxiv.org/abs/2211.08517 · HTML: https://mlsanity.com/paper/2211.08517/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 5 of its 19 references that are in the map.
- First posted on arXiv 15 Nov 2022.

## Builds on (most cited first, 5 of 5)

- [SySeVR: A Framework for Using Deep Learning to Detect Software Vulnerabilities](https://mlsanity.com/paper/1807.06756/) (2018)
- [VulDeeLocator: A Deep Learning-based Fine-grained Vulnerability Detector](https://mlsanity.com/paper/2001.02350/) (2020)
- [LEOPARD: Identifying Vulnerable Code for Vulnerability Assessment through Program Metrics](https://mlsanity.com/paper/1901.11479/) (2019)
- [On using distributed representations of source code for the detection of C security vulnerabilities](https://mlsanity.com/paper/2106.01367/) (2021)
- [Automated Performance Testing Based on Active Deep Learning](https://mlsanity.com/paper/2104.02102/) (2021)

## Built on by (most cited first, 2 of 2)

- [Harnessing the Power of LLMs in Source Code Vulnerability Detection](https://mlsanity.com/paper/2408.03489/) (2024)
- [A Survey of Source Code Representations for Machine Learning-Based Cybersecurity Tasks](https://mlsanity.com/paper/2403.10646/) (2024)

## Abstract (arXiv)

Software vulnerabilities, caused by unintentional flaws in source codes, are the main root cause of cyberattacks. Source code static analysis has been used extensively to detect the unintentional defects, i.e. vulnerabilities, introduced into the source codes by software developers. In this paper, we propose a deep learning approach to detect vulnerabilities from their LLVM IR representations based on the techniques that have been used in natural language processing. The proposed approach uses a hierarchical process to first identify source codes with vulnerabilities, and then it identifies the lines of codes that contribute to the vulnerability within the detected source codes. This proposed two-step approach reduces the false alarm of detecting vulnerable lines. Our extensive experiment on real-world and synthetic codes collected in NVD and SARD shows high accuracy (about 98%) in detecting source code vulnerabilities.