# Behind the Code: Identifying Zero-Day Exploits in WordPress
## 2 Literature Review  
The field of cybersecurity research is rapidly advancing, with various methods, including both traditional and AI-based approaches, being utilized for vulnerability detection. Traditional methods of vulnerability detection have played a crucial role in cybersecurity over the years. These methods can be broadly categorized into signature-based, heuristic-based, and anomaly-based detection. Signature-based detection relies on a database of known vulnerability signatures to identify threats. This method matches patterns in the code against known signatures, effectively identifying previously documented vulnerabilities [1]. It is a well-established technique but struggles with detecting new, unknown threats because it can only identify attacks with pre-existing signatures [33]. Despite its effectiveness for known vulnerabilities, signature-based detection is ineffective against zero-day vulnerabilities, as it relies on existing signatures and cannot detect novel threats [1]. Notable tools that employ signature-based detection include Snort and NetSTAT [34]. Heuristic-based detection uses algorithms to identify potentially malicious behavior based on certain predefined rules. This approach aims to detect new, unknown vulnerabilities by analyzing the behavior and characteristics of software [2]. Although heuristic methods offer some flexibility in identifying new threats, they often result in high false-positive rates and may not effectively detect sophisticated or novel attacks [35]. Anomaly-based detection identifies deviations from established normal behavior profiles. By monitoring for anomalies, this method can potentially detect novel attacks. However, it often requires extensive training data to establish accurate behavior profiles and can suffer from high false-positive rates [3]. The requirement for large amounts of training data and the propensity for false positives are significant challenges for anomaly-based detection methods [3]. Nevertheless, anomaly-based intrusion detection systems (AIDS) are advantageous in detecting zero-day attacks as they do not rely on a pre-existing signature database [34]. They create models of normal behavior and flag deviations as potential threats, making them suitable for identifying novel attacks [36]. Despite their importance, traditional approaches face several challenges and limitations. Signature-based detection is ineffective against zero-day vulnerabilities as it relies on known signatures [1]. Heuristic-based detection suffers from high false-positive rates and limited effectiveness against sophisticated attacks [2]. Anomaly-based detection requires extensive training data and is prone to high false-positive rates [3]. These limitations highlight the need for more advanced and proactive security measures. In contrast, AI, ML, and DL approaches have been proposed to enhance vulnerability detection capabilities. [PERSON] et al. [12] investigate various detection and prevention methods for zero-day attacks, including machine learning algorithms to identify abnormal activities. [PERSON] et al. [37] emphasize the limitations of traditional methods and examine machine learning methodologies for zero-day attack detection, highlighting the challenges of limited labeled data and proposing future research directions. [PERSON] et al. [38] and [PERSON] et al. [39] explore deep learning techniques, such as support vector machines and generative adversarial networks, for malware classification and threat detection, demonstrating high accuracy but also noting significant challenges related to data diversity and model adaptability. [PERSON] [40] examines factors influencing the timing of patch releases for zero-day vulnerabilities, utilizing survival analysis to highlight the impacts of various variables on patch release timing. This study identifies gaps in fully understanding all variables influencing patch release timings, suggesting opportunities for future research. Fuzzing is another traditional method extensively used in vulnerability detection.