Title: SySeVR: A Framework for Using Deep Learning to Detect Software Vulnerabilities,
Abstract: The detection of software vulnerabilities (or vulnerabilities for short) is
an important problem that has yet to be tackled, as manifested by many
vulnerabilities reported on a daily basis. This calls for machine learning
methods to automate vulnerability detection. Deep learning is attractive for
this purpose because it does not require human experts to manually define
features. Despite the tremendous success of deep learning in other domains, its
applicability to vulnerability detection is not systematically understood. In
order to fill this void, we propose the first systematic framework for using
deep learning to detect vulnerabilities. The framework, dubbed Syntax-based,
Semantics-based, and Vector Representations (SySeVR), focuses on obtaining
program representations that can accommodate syntax and semantic information
pertinent to vulnerabilities. Our experiments with 4 software products
demonstrate the usefulness of the framework: we detect 15 vulnerabilities that
are not reported in the National Vulnerability Database. Among these 15
vulnerabilities, 7 are unknown and have been reported to the vendors, and the
other 8 have been "silently" patched by the vendors when releasing newer
versions of the products.