# Improving VulRepair's Perfect Prediction by Leveraging the LION Optimizer
## 1 Introduction  
Software vulnerabilities refer to defects in programming codes or applications that could be exploited by attackers. These vulnerabilities allow attackers to gain access to or damage a computer system. It is apparent that they need to be addressed. The importance of this research is to evaluate and improve tools, specifically AIBugHunter, as it is used to address attacks. AIBugHunter is a tool that scans C/C++ programs, finds code that is vulnerable or susceptible to attacks, identifies the CWE (Common Weakness Enumeration) type of vulnerability, estimates the CVSS (Common Vulnerability Scoring System) vulnerable severity score, explains the vulnerability, and suggests the proper repair. It was developed by the ASWM research group, as reported by [PERSON] et al. (accessed on 2 February 2024 and available at [[https://github.com/awsm-research/VulRepair/](https://github.com/awsm-research/VulRepair/)]([https://github.com/awsm-research/VulRepair/](https://github.com/awsm-research/VulRepair/)))--who stated that most vulnerabilities are found in C compared to other programming languages [1]. Although there are many Integrated Development Environments (IDEs), the tool can be found and installed in Visual Studio Code as an extension. A Common Weakness Enumeration, or CWE, is a list of common software and hardware weaknesses that address security concerns. A weakness is a condition in a computer system, including software, hardware, etc., that could cause a vulnerability and should not be used [2]. Regarding software weaknesses, developers cause them when writing programs in specific ways that could be exploited. When creating a CWE, a unique number is assigned to it, referred to as a CWE ID. A created CWE also has a name that describes the weakness, a summary of the weakness, an extended description, the modes of introduction, potential mitigations, common consequences, applicable platforms, demonstrative examples, observed examples, relationships, and references. CWE is a method software developers can use to become aware of and eliminate vulnerabilities or security flaws in their programs. In general, it describes the weakness and provides guidance on how it can be avoided. If a vulnerable function is found, AIBugHunter predicts the CWE-ID, the CWE type, and the severity of the vulnerable function via the Common Vulnerability Scoring System (CVSS) severity score. The CVSS serves as an industry standard for assessing the impact of vulnerabilities in computer systems. It is beneficial as it offers insights and prompts the necessary responses. The scoring system ranges from 0 to 10, where a score of 10 indicates extreme severity that requires urgent action. The CVSS v3.x ratings are categorized as follows: 0, which means no severity; 0.1 to 3.9, which means low severity; 4 to 6.9, which means medium severity; 7 to 8.9, which means high severity; and 9 to 10, which is critical. More information is available at the National Vulnerabilities Database (NVD) website [3]. On the back end, AIBugHunter integrates LineVul and VulRepair to locate and repair vulnerabilities. LineVul is a transformer-based approach that predicts vulnerable functions and identifies vulnerable lines within programs written in C/C++ code. It addresses the limitations of IVDetect by [PERSON] et al [4]. IVDetect is an AI vulnerability detector that uses an intelligence assistant and outperforms 2021 deep learning models [5]. VulRepair, also integrated into AIBugHunter, relies on a T5 architecture. T5 is a natural language processing (NLP) model developed by Google in 2019 [6]. T5 is short for text-to-text transfer transformer with layers that consist of an encoder and decoder neural network. The encoder is used for the input sequence, while the decoder is used for the output sequence. VulRepair's T5 makes use of both natural and programming languages and byte pair encoding (BPE), outperforming other models such as VRepair and CodeBERT.