A transformer-based IDE plugin for vulnerability detection

• Type: Article in International Conference Proceedings Book
• Date: 2022

Authors

Mamede, C (Author) Other; Pinconschi, E (Author) Other; Rui Abreu (Author) FEUP

Conference proceedings International

Title: 37th IEEE/ACM International Conference on Automated Software Engineering, ASE 2022, Rochester, MI, USA, October 10-14, 2022

7th International Workshop on Sensor-Based Activity Recognition and Artificial Intelligence, iWOAR 2022

19 September 2022 through 20 September 2022

Indexing

ISI Web of Knowledge - 0 Citations

Scopus

Other information

Authenticus ID: P-00X-VQ4

DOI: 10.1145/3551349.3559534

Abstract (EN): Automatic vulnerability detection is of paramount importance to promote the security of an application and should be exercised at the earliest stages within the software development life cycle (SDLC) to reduce the risk of exposure. Despite the advancements with state-of-the-art deep learning techniques in software vulnerability detection, the development environments are not yet leveraging their performance. In this work, we integrate the Transformers architecture, one of the main highlights of advances in deep learning for Natural Language Processing, within a developer-friendly tool for code security. We introduce VDet for Java, a transformer-based VS Code extension that enables one to discover vulnerabilities in Java files. Our preliminary model evaluation presents an accuracy of 98.9% for multi-label classification and can detect up to 21 vulnerability types. The demonstration of our tool can be found at https://youtu.be/OjiUBQ6TdqE, and source code and datasets are available at https://github.com/TQRG/VDET-for-Java.

Language: English

Type (Professor's evaluation): Scientific

No. of pages: 4