###### Abstract  
Software vulnerabilities in web applications are one of the sensitive points in data and application security. Although closing a vulnerability after it is detected in web applications seems to be a solution, detecting vulnerabilities in the source code before the vulnerability is detected effectively prevents malicious attacks. In this paper, we present an improved and automated Bidirectional Encoder Representations from Transformers (BERT)-based approach to detect vulnerabilities in web applications developed in C-Sharp. For the training and testing of the proposed VULREM (Vulnerability Remzi) model, a dataset of eight different CVE (Common Vulnerabilities and Exposures)-numbered critical vulnerabilities was created from the source code of six different applications specific to the study. In the VULREM model, fine-tuning was performed within the BERT model to obtain maximum accuracy from the dataset. To obtain the optimum performance according to the number of source-code lines, six different input lengths were tested with different batch sizes. Classification metrics were used for the testing and performance evaluation of the model, and an average F1-score of 99% was obtained for the best sequence length according to eight different vulnerability classifications. In line with the findings obtained, this will play an important role in both vulnerability detection in web applications of the C-Sharp language and in detecting and correcting critical vulnerabilities in the developmental processes of web applications, with an accuracy of 99%. fine-tuned BERT; source-code vulnerability; detection system +
Footnote †: journal: Applied Sciences  
0
Footnote 0: _Applied Sciences_  
file uploads, insecure authentication and authorization, insecure connection and communication and insecure routing and communication are common vulnerability points [5; 6; 7]. Penetration tests are commonly preferred to test vulnerabilities. Penetration tests reveal the existing vulnerabilities of the web application [8]. Common Vulnerabilities and Exposures (CVE) represents processes to identify, describe and catalog cyber vulnerabilities that have been identified and publicly disclosed. CVE is a vulnerability database in which each vulnerability contains a unique identifier code along with a description of the vulnerability and other useful information [9]. In the CVE database, vulnerabilities are shared on a scale of 1-10 to determine the severity of each vulnerability. The scaling of vulnerabilities in the CVE database between 1 and 10 is called the Common Vulnerability Scoring System (CVSS) [10]. CVSS assigns scores out of 10 to vulnerabilities using certain algorithms and metrics. Vulnerabilities are then grouped according to their scores. These groups are formed according to the importance of the vulnerabilities they contain. CVSS then groups vulnerabilities into two different versions, CVSS v2.0 and CVSS v3.0 [11]. Vulnerability detection systems need to be continuously expanded and improved in order to instantly discover new threats. There are many important criteria to assess the challenges of detection to protect the security of applications and systems as the scale, time, technical and computing requirements of applications increase. This emphasizes the need to quickly and clearly identify vulnerabilities in complex systems. In addition, it can be difficult to strike a balance between true positives and false positives when optimizing coverage. Increasing the sensitivity of scanning tools both increases measurements and overwhelms security teams with alerts [12]. Reducing the sensitivity and power has the opposite effect, giving the application a false sense of security. Finally, attackers have started to exploit multiple vulnerabilities in a system in parallel or in a chain. These are much harder to detect, and a few low-risk vulnerabilities alone may not trigger an alarm on any system. All these issues and requirements reveal the many advantages of evaluating vulnerability detection at the source-code stage.