# VulDeePecker: A Deep Learning-Based System for Vulnerability Detection

**Authors:** Zhen Li, Deqing Zou, Shouhuai Xu, Xinyu Ou, Hai Jin, Sujuan Wang, Zhijun Deng, Yuyi Zhong  
**arXiv:** [1801.01681](https://arxiv.org/abs/1801.01681)  
**Date:** 2018-01-05  
**Summary page:** https://www.summarizepaper.com/en/paper/1801.01681v1/

## Key points

- Automatic detection of vulnerabilities in software security is a critical area of research
- Traditional methods rely on human experts, leading to high false negative rates
- Deep learning-based vulnerability detection offers promise for accuracy and efficiency
- Challenge lies in finding suitable representations of software programs for deep learning algorithms
- Proposal to use code gadgets as structured representations for deep learning analysis
- Development of Vulnerability Deep Pecker (VulDeePecker) system for vulnerability detection using deep learning
- Experimental results show significant reduction in false negatives with reasonable false positive rates compared to existing approaches
- VulDeePecker successfully uncovers previously undetected vulnerabilities in software products Xen, Seamonkey, and Libav
- Superior performance of VulDeePecker compared to other systems in identifying critical security flaws

## Summary

In the realm of software security, the automatic detection of vulnerabilities is a critical area of research. Traditional methods for identifying these vulnerabilities often rely on human experts to manually define features, leading to a high rate of false negatives. To address this issue, this paper introduces a novel approach using deep learning-based vulnerability detection to alleviate the burden on human experts and enhance accuracy. Known for its ability to tackle complex problems, deep learning presents a promising avenue for vulnerability detection. However, adapting deep learning techniques to this specific domain requires careful consideration and guiding principles. One key challenge lies in finding suitable representations of software programs that can be effectively processed by deep learning algorithms. To overcome this challenge, the authors propose utilizing code gadgets as representations of programs. Code gadgets are defined as sets of lines of code that are semantically related, offering a structured way to transform program data into vectors suitable for deep learning analysis. This innovative approach culminates in the development of a deep learning-based vulnerability detection system named Vulnerability Deep Pecker (VulDeePecker). In order to evaluate the effectiveness of VulDeePecker, the authors introduce a new vulnerability dataset tailored for deep learning methodologies. Experimental results demonstrate that VulDeePecker significantly reduces false negatives while maintaining reasonable false positive rates compared to existing approaches. Furthermore, the authors apply VulDeePecker to analyze three software products – Xen, Seamonkey, and Libav – uncovering four previously undetected vulnerabilities. These vulnerabilities had not been reported in the National Vulnerability Database but were silently addressed by vendors in subsequent product releases. Notably, other vulnerability detection systems tested in the study largely overlooked these vulnerabilities, highlighting the superior performance of VulDeePecker in identifying critical security flaws. Overall, this research showcases the potential of leveraging deep learning techniques for enhancing software vulnerability detection and underscores the importance of developing specialized methodologies tailored to the unique challenges posed by cybersecurity threats.