# A Comprehensive Review and Assessment of Cybersecurity Vulnerability Detection Methodologies
## 4 Taxonomy of Vulnerability Detection Approaches and Findings Analysis
### AI-Based Approach
#### 4.4.1 AI-Based Approach Methods Description  
In 2018, the authors published a new method called Vulnerability Deep Pecker (VulDeePecker). The purpose of the method is to integrate deep learning into the software vulnerability detection process [109]. Based on this work, VulDeePecker automates vulnerability discovery by lowering the reliance on human experts, reducing false positive and negative rates, and enhancing detection accuracy. As one of the first attempts to integrate deep learning into vulnerability detection, VulDeePecker operates in two phases: learning and detection. The learning phase uses a large number of code gadgets classified as vulnerable or not for training the Bidirectional Long Short-Term Memory (BLSTM) network using Theano [98] and Keras [110]. In addition, the detection phase uses the trained BLSTM network to identify vulnerabilities in the program code. In addition, the target code is systematically converted to a vector using the word2 vec tool [65], making it a suitable input for the BLSTM. Additionally, this model uses two datasets (NVD [36] and SARD [90]) to learn and detect vulnerability patterns from these vectorized code gadgets. Finally, preserving semantic relationships between programs, finer granularity representation of the code, and model suitability for the vulnerability detection context are VulDeePecker's guiding principles for employing deep learning in vulnerability detection. According to the experimental results, VulDeePecker achieved much fewer false negatives than other methods. Method Based on NER  
Another contribution proposed a new solution to address security issues during software development [10]. In this context, Dependency Vulnerability Management (DVM) technologies automate software composition analysis (SCA) to match known vulnerabilities (CVEs) with used software components. It was observed that there was a time lag between the first CVE disclosure and the addition of CPEs to the vulnerability (the median time is almost 35 days). Automated technologies cannot immediately alert developers and users  
Figure 22: Features of AI-based approach. to these vulnerabilities. As a result, software systems may become exposed to attacks during this time lag. This work proposes generating new CPEs from CVE summaries and identifying affected software by the published vulnerabilities using Named Entity Recognition (NER) [111, 112]. The model reduces time lag and helps prevent \"one-day\" vulnerabilities using DVM to immediately estimate CPEs associated with a CVE. The workflow begins with gathering CVE IDs, summaries, and potential CPEs from NVD followed by the Feature Engineering (FE) stage, which includes four steps: (i) Character Level Features enable learning security-related semantics using one-dimensional convolution (CNN-layer) [111]; (ii) Word Level Embeddings convert each word into a 50-, 100-, 200-, or 300-dimensional numerical vector reflecting the semantic content of the word using glove embeddings; (iii) Word Level Case Features contribute to ascertaining the label of the particular word; and (iv) Security Lexicon uses NVD information to create a glossary of frequently used lexicon linked to CPE. Next, outputs from the FE stage are used by the Bidirectional Long-Short-Term Memory (BLSTM) network to capture a word's context in both forward and backward directions [113]. Then, the Conditional Random Field (CRF) is used to forecast the word label sequence by assigning a class to each word [101]. Following the training and optimization stages, models assist the prompt detection and remediation of vulnerabilities in DVM. They provide real-time CPE estimations for newly discovered CVEs with minimal latency. Method Based on ML  
In the same field of research, this method suggested a recommender system for tracking vulnerabilities that addresses the matching issue between public notifications from VBDs and the potentially vulnerable products in an enterprise information system [114]. This method provides a shortlist of candidate matches for human verification.