# Detection of Software Security Weakness Using Cross-Language Source Code Representation (CLaSCoRe)
## 4 Experimental Results
### Learning Scenario \"Other to C#\"
For the \"C# to C#\" scenario, the accuracy mean is 0.97 with a standard deviation averaging at 0.017. We obtained an average recall score equal to 0.80 in the \"Other to C#\" scenario for SVM and a recall score equal to 0.95 in the \"C# to C#\" scenario, for the same machine learning algorithm. This result can be interpreted in the following way: if we are able to identify 95% of the vulnerable code in a C# dataset, using a method based on CLaSCoRe representation and a C# dataset for training, in the same way, we are able to identify 80% of the vulnerable code in the C# dataset after training the algorithm to detect security vulnerabilities in C, C++, and Java code written by programmers within the same community of developers. The performance of CLaSCoRe representation in the \"Other to C#\" scenario, as zero-shot classification, has been in average F1 = 0.80 on the NIST SARD dataset, and 0.95 in the \"C# to C#\" scenario, better than in similar approaches [26]. The advantage of learning from multiple languages that are linked together by a lexical and semantical inheritance is essential for zero-shot software security scanners. More, the loosely coupled control and data flow vectors make the ClaSCoRe representation partially language agnostic and, at the same time, able to capture the patterns of security vulnerabilities (CWEs) which are shaped by both reserved keywords, methods, functions, and developers' defined variables being processed by them. The model is able to partially fill the gap between the structure, \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline \multirow{2}{*}{**CWE Name**} & \multicolumn{5}{c}{**Scenario “Other to C#”**} & \multicolumn{5}{c}{**Scenario “C\# to C#”**} \\ \cline{2-9}  & \multirow{2}{*}{**F1 (SVM)**} & **Recall** & **Precision** & **Accuracy** & **F1 (SVM)** & **Recall** & **Precision** & **Accuracy** \\  & & **(SVM)** & **(SVM)** & **Mean (SVM)** & **F1 (SVM)** & **(SVM)** & **(SVM)** & **Mean (SVM)** \\ \hline CWE190 & 0.75 & 0.82 & 0.69 & 0.91 & 0.95 & 0.94 & 0.96 & 0.97 \\ CWE191 & 0.73 & 0.82 & 0.67 & 0.91 & 0.93 & 0.94 & 0.93 & 0.97 \\ CWE78 & 0.72 & 0.80 & 0.65 & 0.91 & 0.82 & 0.99 & 0.70 & 0.98 \\ CWE369 & 0.75 & 0.78 & 0.71 & 0.86 & 0.83 & 0.95 & 0.74 & 0.95 \\ CWE789 & 0.68 & 0.78 & 0.61 & 0.95 & 0.91 & 0.94 & 0.89 & 0.97 \\ CWE400 & 0.70 & 0.82 & 0.61 & 0.83 & 0.94 & 0.98 & 0.90 & 0.98 \\ CWE197 & 0.69 & 0.80 & 0.60 & 0.87 & 0.96 & 0.94 & 0.99 & 0.96 \\ CWE606 & 0.77 & 0.75 & 0.79 & 0.88 & 0.82 & 0.96 & 0.72 & 0.98 \\ \hline \hline \end{tabular}
\end{table} 
Table 8: F1, recall, precision, and accuracy scores of the Support Vector Machines classifier applied to the 8 CWEs in scope, in the “C# to C#” and, respectively, “Other to C#” learning scenarios. lexical, and semantic differences between programming languages, especially when they are strongly interconnected on the language influence map. The inheritance at lexical and semantical levels, transmitted \"genetically\" to newer programming languages from their \"ancestors\", is valuable to security analysts when datasets and skills are limited for new, not-yet-popular languages. Programs written in downstream languages, influenced by more popular ones, do not benefit, in general, from the same number of software security experts and technologies to detect security weaknesses (CWEs) in the early versions of applications developed by the same community of programmers. Using the CLaSCoRe representation of source code, we were able to detect security vulnerability patterns in software written in a different language than the ones used for training, as long as the code was written in a downstream language, and we had enough samples in upstream languages. We observe that most graph-based representations are not identified as cross-language or language agnostic, their dependency on the programming language being higher than in our model.