# A Comprehensive Review and Assessment of Cybersecurity Vulnerability Detection Methodologies
## 4 Taxonomy of Vulnerability Detection Approaches and Findings Analysis
### AI-Based Approach
#### 4.4.1 AI-Based Approach Methods Description
The ASSBert pipeline begins with data preprocessing (cleaning and formatting), followed by feature extraction (tokenization, updating the BERT model, padding checking), and an active learning module to select the most uncertain samples for manual labeling and model creation. After evaluating the uncertainty, a semi-supervised learning module predicts labels for high-confidence samples, followed by iterative training and improvement of the BERT model using manual and pseudo-labeled data. Method Based on Repository-Level Evaluation System  
This new study has recently introduced a novel technique called VulEval [127]. It aims to reduce the impact of insecure code in software engineering [128]. The method discover vulnerabilities at the granularity of individual functions or files (inter-procedure) and across multiple files or repositories (inter-procedure) and predicts relevant dependencies related to vulnerabilities. To achieve this, repository-level data and contextual dependencies are incorporated into VulEval to overcome some limitations of existing vulnerability detection techniques. To do this, VulEval starts with data processing by gathering CVE entries, vulnerability patches, and C/C++ programming language types. There are three assessment tasks in VulEval. Initially, it predicts if a source code fragment has a vulnerability. Second, using the (Callee and Caller) process, VulEval determines the vulnerability level between each possible dependence (retrie from the call graph) and the input code snippet. Third, VulEval utilizes the \"Detector\" to integrate dependencies found in the second task and determine if the input (target function) is an inter-procedural vulnerability. This last task uses two open-source LLMs: LLMa [129] and CodeLlama [130], as well as two closed-source LLMs: GPT-3.5-turbo and GPT-3.5-instruct (ChatGPT) [131], developed by OpenAI. The findings show that ChatGPT performs better in all empirical assessments. In addition, lexical-based methods are more successful than semantic ones in detecting dependencies, and incorporating vulnerability information at the repository level enhances model performance. Method Based on Gradient Boosting Machine (GBM) and Lasso Regression  
To reduce the severe risk from ransomware targeting IIoT (Industrial Internet of Things), running on ZephyrOS, a combination methodology is proposed based on GBM and Lasso Regression [132]. The hybrid solution used GBM to leverage large datasets to build decision trees and predict unusual patterns in SCADA (Supervisory Control and Data Acquisition) systems. Then, Lasso Regression focused on preventing overfitting by zeroing down irrelevant features and focusing on critical predictors of ransomware activity. By continuously monitoring data streams, the proposed solution notifies unusual activities from file extensions and directory structure changes, network traffic, resource utilization, and file encryption behaviors. When the anomaly score exceeds, the system immediately responds by isolating the affected device from the network to prevent ransomware spread and other preventive measures. More details are summarized in Table 6.