# Automated Software Vulnerability Detection Based on Hybrid Neural Network
## 5 Conclusions  
In this paper, a novel approach that detects source code vulnerabilities automatically is proposed. The programs are transformed into intermediate representations first. LLVM IR and backward program slicing are utilized. The transformed intermediate representation not only eliminates irrelevant information but also represents the vulnerabilities with explicit dependency relations. Then, a hybrid neural network is proposed to learn both local and long-term features of a vulnerability. We have achieved a prototype. The experiment results show that our approach outperforms state-of-the-art methods.  
The proposed approach has several limitations, which can be further investigated. Firstly, our method is applied to detect vulnerabilities in source code written in C language at present. In theory, our approach can be applied to other programming languages as well. Therefore, applying our methods to other languages is one of the interesting future works. Secondly, our approach is only conducted on the SARD dataset due to the lack of labeled vulnerability datasets and falls into in-project vulnerability detection. The lack of labeled datasets is an open problem restricting the development of automated vulnerability detection technology. Existing vulnerability datasets suffer from the wrong labels and coarse-grained vulnerability descriptions. For example, the VDISC dataset is generated by the traditional static detection method. However, the conventional static detection method itself has the problem of a high false positive rate. The NVD dataset only provides the difference between the vulnerability sample and the patch. It is difficult to locate the security sensitive program point. Therefore, one of the interesting future works is proposing a method to generate labels on real world software and transfer the learned vulnerable patterns to detect vulnerabilities in a new project. Transfer learning and graph-based representation learning method should be applied in future work to solve the cross-project task. Thirdly, the inputs processed by our method should be able to be compiled. This means further effort is needed for compiling when only a code snippet is accessible.  
Conceptualization, X.L.; methodology, X.L.; software, X.L. and L.W.; validation, X.L., L.W., and Y.X.; formal analysis, X.L. and L.W.; investigation, X.L.; resources, Y.X., L.W., and Y.Y.; data curation, Y.X. and Y.Y.; writing--original draft preparation, X.L.; writing--review and editing, X.L.; visualization, X.L. and L.W.; supervision, Y.X. and Y.Y.; project administration, Y.X.; funding acquisition, Y.X., Y.Y., Q.T., and Y.C. All authors have read and agreed to the published version of the manuscript.  
This research was funded by the \"Major Scientific and Technological Special Project of Guizhou Province (20183001)\", and the \"Foundation of Guizhou Provincial Key Laboratory of Public Big Data (2017 BDKFJ015, 2018 BDKFJ020, 2018 BDKFJ021)\".  
Not applicable.  
Data Availability Statement: Data available in a publicly accessible repository that does not issue DOIs. Publicly available datasets were analyzed in this study. This data can be found here: [[https://samate.nist.gov/index.php/SARD.html](https://samate.nist.gov/index.php/SARD.html)]([https://samate.nist.gov/index.php/SARD.html](https://samate.nist.gov/index.php/SARD.html)) (accessed on 2 April 2021).  
The authors declare no conflict of interest.