# Detection of Software Security Weakness Using Cross-Language Source Code Representation (CLaSCoRe)
## 3 The Proposed Architecture for the Cross-Language Source Code Representation  
We propose the architecture presented in Figure 1, to transform source code written in various programming languages into the CLaSCoRe representation. This concept builds on our previous research related to machine-learning-based security pattern recognition techniques [8], able to detect security weaknesses in C/C++ and Java using a mix of keywords (tokens) from both languages. The CLaSCoRe representation maintains the minimal, core traits of source code needed to classify it as \"vulnerable\" or \"not vulnerable\", although it is less dependent on the lexical and semantical structure of the original programming language.  
\begin{table}
\begin{tabular}{c c c c c c c c c c} \hline \hline  & & & \multicolumn{3}{c}{**Functionality \&**} & \multicolumn{3}{c}{**Based on**} & \multicolumn{3}{c}{**Datasets**} \\ \cline{2-10}  & & & & & & & & & & \\ \cline{2-10}  & & & & & & & & & & & \\ \[PERSON] & & & & & & & & & & \\ (2013) & & x & x & & & & & & & \\ \hline CPG & & & & & & & & & & \\ (2014) & & x & & & & & & & & \\ \hline [PERSON] et al. & & & & & & & & & & & \\ (2018) & x & & & & x & RF & x & x & x & Draper \\ \hline AltVA & & & & & & & & & & & \\ (2020) & x & & & & & & & & & \\ \hline [PERSON] & & & & & & x & RNN & x & x & x & \\ (2020) & x & & & & & & & & & \\ \hline SySeVR & & & & & & & & & & \\ (2020) & x & x & & & & & & & & \\ \hline [PERSON] et al. & & & & & & & & & & \\ (2022) & x & & & & & & & & & \\ \hline [PERSON] et al. & & & & & & & & & & \\ (2022) & x & & & x & RF, DT & x & x & x & & \\ \hline ML-FEED & & & & & & & & & & & \\ (2022) & x & & & & & & & & & & \\ \hline DeepVulSeeer & & & & & & & CNN/FNN & x & & x & x & QEMU, FFMPEG \\ (2023) & x & & & & & & & & & & & \\ \hline ChaGPT 3.5 & & & & & & & & & & & & \\ (2023) & x & & & x & x & x & LLM & x & & & & \\ \hline ChatGPT 3 & & & & & & & & & & & QuixBugs \& \\ (2023) & & x & x & x & x & LLM & x & & & & & Large data \\ \hline CodeBERT & & & & & & & & & & & & \\ (2023) & & x & & & & & & & & & \\ \hline CLaSCoRe & & & & & & & & & & & & \\ (2023) & x & & & & & & & & & & & \\ \hline \hline \end{tabular}
\end{table}
Table 1: State of the Art in Machine Learning and Natural Language Processing based Source Code Security Scanners.  
Examples of code snippets from NIST datasets, with vulnerable functions written in Java and C#, input to the Tokenizer, are displayed in Table 2. The steps for building the ClaSCoRe representation are described in more detail below.  
\begin{table}
\begin{tabular}{l l} \hline \hline
**Java Vulnerable Function** & **C\# Vulnerable Function** \\ \hline \hline public void bad() throws Throwable & public override void Bad() \\ \{ & string data; \\ if (PRIVATE\_STATIC\_FINAL\_FIVE == 5) & if (PRIVATE\_CONST\_TRUE) \\ \{ & data = Environment. \\ \} & \\ \{ & data = Environment. \\ GetEnvironmentVariable(”ADD”); & GetEnvironmentVariable(”ADD”); \\ \} & \\ \{ & else \\ data = null; & \\ \} & \\ String osCommand; & string osCommand; \\ if (System.getProperty(\"os.name”).toLowerCase(). \\ indexOf(”win”) \textgreater{}= 0) & if (RuntimeInformation. \\ \{ & IsOSCommand = “c\textbackslash{}WINDOWS\textbackslash{} \\ SYSTEM32\textbackslash{}cmd.exe /c dir ”; \\ \} & else \\ \{ & osCommand = “/bin/ls \"; \\ \} & Process process = Runtime.getRuntime(). \\ exec(osCommand + data); & \\ process.waitFor(); & \\ \hline \hline \end{tabular}
\end{table}
Table 2: CWE 78 (OS Command Injection using Use environment variable) vulnerability in Java and C# code.  
Figure 1: Cross Language Source Code Representation development architecture.