AI-Based Software Vulnerability Detection: A Systematic Literature Review

2025/06/12 by Samiha Shimmi, Hamed Okhravi, Shimmi, Samiha +3
Computer Science · #Software Engineering Research #Information and Cyber Security #Advanced Malware Detection Techniques

paper · pdf · doi:10.48550/arxiv.2506.10280

Abstract

Software vulnerabilities in source code pose serious cybersecurity risks, prompting a shift from traditional detection methods (e.g., static analysis, rule-based matching) to AI-driven approaches. This study presents a systematic review of software vulnerability detection (SVD) research from 2018 to 2023, offering a comprehensive taxonomy of techniques, feature representations, and embedding methods. Our analysis reveals that 91% of studies use AI-based methods, with graph-based models being the most prevalent. We identify key limitations, including dataset quality, reproducibility, and interpretability, and highlight emerging opportunities in underexplored techniques such as federated learning and quantum neural networks, providing a roadmap for future research.

Citations

• XGV-BERT: Leveraging Contextualized Language Model and Graph Neural Network for Efficient Software Vulnerability Detection
• When Less is Enough: Positive and Unlabeled Learning Model for Vulnerability Detection
• DiverseVul: A New Vulnerable Source Code Dataset for Deep Learning Based Vulnerability Detection
• Open Science in Software Engineering: A Study on Deep Learning-Based Vulnerability Detection
• Data Quality for Software Vulnerability Datasets
• An Empirical Study of Deep Learning Models for Vulnerability Detection
• Example-Based Vulnerability Detection and Repair in Java Code
• Evaluation of Static Vulnerability Detection Tools with Java\n Cryptographic API Benchmarks
• A ground-truth dataset of real security patches
• ReGVD: Revisiting Graph Neural Networks for Vulnerability Detection
• VulSPG: Vulnerability detection based on slice property graph representation learning
• Security Vulnerability Detection Using Deep Learning Natural Language Processing
• BGNN4VD: Constructing Bidirectional Graph Neural-Network for Vulnerability Detection
• D2A: A Dataset Built for AI-Based Vulnerability Detection Methods Using Differential Analysis
• CodeXGLUE: A Machine Learning Benchmark Dataset for Code Understanding\n and Generation
• Deep Learning based Vulnerability Detection: Are We There Yet?
• DeepBalance: Deep-Learning and Fuzzy Oversampling for Vulnerability Detection
• Language Models are Few-Shot Learners
• Devign: Effective Vulnerability Identification by Learning Comprehensive Program Semantics via Graph Neural Networks
• GNNExplainer: Generating Explanations for Graph Neural Networks
• A Manually-Curated Dataset of Fixes to Vulnerabilities of Open-Source Software
• Automated Vulnerability Detection in Source Code Using Deep Representation Learning
• CryptoGuard: High Precision Detection of Cryptographic Vulnerabilities in Massive-sized Java Projects
• SoK: Sanitizing for Security
• Attention Is All You Need
• "Why Should I Trust You?": Explaining the Predictions of Any Classifier
• Mitigating program security vulnerabilities
• BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding
• The Graph Neural Network Model

Related

• Deep Learning Aided Software Vulnerability Detection: A Survey
• A Survey on Automated Software Vulnerability Detection Using Machine Learning and Deep Learning
• SAFE: Advancing Large Language Models in Leveraging Semantic and Syntactic Relationships for Software Vulnerability Detection
• SHERLOCK: A Deep Learning Approach To Detect Software Vulnerabilities
• Direction for Detection: A Survey of Automated Vulnerability Detection and all of its Pain Points