# Machine Learning-Based Security Pattern Recognition Techniques for Code Developers
## 4 Discussion and Related Work
### Related Work for CWE Detection in Source Code  
A similar approach [4] of CWE security vulnerabilities detection in source code considers deep learning for this goal, the authors using \"code gadgets\" to represent programs in a granular way, then vectorized as input to deep learning. The authors declare solution's limitations to vulnerabilities dealing only with library/API calls. Our solution does not have any limitation to specific libraries or API call, as long there is a possibility to capture the CWE pattern with the tokens in our inventory. In other words, if a specific CWE pattern is strongly attached to specific tokens which are not considered in the vocabulary (e.g., arithmetic operands like \"+\" or \"-\"), those specific CWEs are not detected by their solution. Other studies propose methods strongly related to one or two programming languages, even when the concept may be replicated for different languages. The drawback comes from the cumulated time and from the required expertise in both the new language scanner to be implemented and the static analysis concept itself defined in the respective study. Our future intention is to make this concept portable with ease to other programming languages, being linked mostly to the way programmers of specific communities or organizations are used to write code, by maintaining a loosely coupled control and data flow to the structure of the assessed programming language, in this case C/C++. For example, one method \"to expose missing checks in source code\", such as input validation, named Chucky [5], is developed as a static analysis tool and is able to recommend potential fixes to security analysts. The researchers used models from natural language processing, such as the \"bag-of-words\" model [6], to identify the neighboring function, practically the context of source and sink of one vulnerability. The coverage is for C/C++, and the authors developed their own robust parser for C/C++ to identify sources and sinks, based on the concept of island grammars. Having a robust parser able to understand C/C++ improve detection in these programming languages, but it is not highly portable to other programming languages used by a community of programmers. [PERSON] et al. [7] recommend using two combined approaches to increase detection performance: source-based and build-based models. The source-based model considers extracting features directly from the source code and has the advantage that it can learn statistical correlations in how code is written, using natural language processing techniques. The build-based model extracts features from the compiling process, being able to understand the structure of the language. [PERSON] et al. [9] apply deep learning techniques to learn the features directly from source code. To select the relevant tokens vocabulary (156 tokens), a specially designed C/C++ lexer is used. The best F1 value for the NIST Juliet test suite is 0.840, when leveraging feature extraction approaches similar to those used for sentence sentiment classification with convolutional neural networks. Recent studies [14; 15; 16; 17] indicate that the semantical representation of source code is an important step in preserving the security weaknesses patterns. [PERSON] et al. [14] use word embedding techniques (Word2 Vec) to maintain the pattern of CWEs after the representing the code as a graph via Code Property Graphs [15] methods. [PERSON] et al. [16] shows that random forest is one of the most reliable machine learning algorithms in detecting security patterns in semantically preserved source code representations. [PERSON] et al. [17] shows that sequence-based approaches (which preprocess source code into token sequences) capture rich semantic features while graph-based models (which convert source code into graph structures) make use of the code's complex structural information. Our proposed architecture uses automated learning techniques based on machine learning algorithms to identify security weaknesses in C/C++ and Java code.