Software Vulnerability Detection Using Ensemble Methods and BERT
摘要
Annually, an escalating quantity of software vulnerabilities is discerned, irrespective of whether they are publicly disclosed or internally detected within proprietary code. To facilitate the process of vulnerability detection and provide support to developers and testers, numerous machine learning-based tools have emerged in recent years. While previous research endeavors have made notable progress, opportunities for enhancing effectiveness and reducing false positives persist. Additionally, certain models employed handpicked features curated by cybersecurity experts for vulnerability detection. It is noteworthy to mention that most of the existing models have been trained and tested on synthetic datasets, which do not represent real-world scenarios. This paper introduces effective system VdBERT and Ensembled-VdBERT that leverage natural language processing on an extensive dataset containing susceptible code patterns. The system is designed to comprehend intricate expressions of vulnerabilities over different datasets and identify instances of vulnerable code patterns. Subsequent to employing Ensemble learning to combine outcomes from five independently fine-tuned BERT models, this paper assess our approaches across various projects. Our outcomes regularly equal or outperform those of the latest methods. According to the evaluation results, ReVeal and DiverseVul exhibit remarkable accuracy scores on datasets like these, with ReVeal and DiverseVul achieving up to 90.4% and 93.4%, respectively.