# PreNNsem: A Heterogeneous Ensemble Learning Framework for Vulnerability Detection in Software
## 5 Conclusions  
In this paper, according to existing detection methods, we analyzed vulnerability detection's core problem, which is the lack of proper feature extraction. Firstly, we researched vulnerability detection methods related to deep learning. We then presented the PreNNsem framework to detect vulnerabilities by analyzing source code. We drew some insights that were based on the collected dataset, including explanations for word embedding, deep learning model, and classifier comparisons in vulnerability detection. We used six different vulnerability datasets to prove our method's generalization ability. Finally, we compared the results that were obtained with our method with those of the state-of-art tools and academic methods to validate the improvement in vulnerability detection.  
In terms of practicality, our summary is as follows: (i) our method performs well on various mixed vulnerability data sets. Our method can detect various vulnerabilities. (ii) Because we analyze the source code from the perspective of analyzing text, other high-level language source code vulnerabilities can also use our framework. (iii) Each part of PreNNsem also supports other methods, which proves the scalability of the framework.  
\begin{table}
\begin{tabular}{l c c c c c} \hline \hline
**Method** & **FPR (\%)** & **FNR (\%)** & **P (\%)** & **R (\%)** & **F1 (\%)** \\ \hline Flawfinder & 46.3 & 69.0 & 23.7 & 40.5 & 29.9 \\ Checkmarx & 43.1 & 41.1 & 39.6 & 58.9 & 47.3 \\ VUDDY & 3.5 & 91.3 & 47.0 & 8.7 & 14.7 \\ VulDeePecker & 2.9 & 18.0 & 91.7 & 82.0 & 86.6 \\ DeepSim & 16.1 & 41.6 & 71.6 & 58.4 & 64.4 \\ VulSniper & 6.42 & 26.2 & 88.7 & 73.8 & 80.6 \\ PreNNsem & 1.5 & 8.0 & 95.4 & 91.9 & 93.6 \\ \hline \hline \end{tabular}
\end{table}
Table 7: Comparison of experimental results obtained using the proposed method and those using state-of-the-art methods.  
However, our method has several limitations: (i) our method only focuses on the source program, and our framework can not be applied in executable programs. (ii) Our approach relies on VulDeePecker's [13] code snipping, which will be proposed and integrated into our future framework. (iii) Although we chose several deep learning models, we need to evaluate other models. (iv) The sample length is padded if it is shorter than the fixed length and cut off if it is longer; future works need to investigate how to handle vectors' varying lengths.  
Conceptualization, L.W. and X.L.; methodology, L.W. and X.L.; software, L.W.; validation, L.W.; formal analysis, L.W.; investigation, L.W. and R.W.; resources, L.W.; data curation, L.W.; writing--original draft preparation, L.W.; writing--review and editing, L.W.; visualization, L.W.; supervision, L.W.; project administration, L.W.; funding acquisition Y.X., Y.C., and M.G. All authors have read and agreed to the published version of the manuscript.  
This work was supported by the Major Scientific and Technological Special Project of Guizhou Province (20183001), the Foundation of Guizhou Provincial Key Laboratory of Public Big Data (No. 2018 BDKFJ021), the Foundation of Guizhou Provincial Key Laboratory of Public Big Data (No. 2017 BDKFJ015), and the National statistical scientific research project of China (2018 LY61, 2019 LY82).  
The authors declare no conflict of interest.