{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/vuldeepecker-a-deep-learning-based-system-for","title":"VulDeePecker: A Deep Learning-Based System for Vulnerability Detection","arxiv_id":"1801.01681","date":"2018-01-05","proceeding":null,"authors":["Zhen Li","Deqing Zou","Shouhuai Xu","Xinyu Ou","Hai Jin","Sujuan Wang","Zhijun Deng","Yuyi Zhong"],"abstract":"The automatic detection of software vulnerabilities is an important research\nproblem. However, existing solutions to this problem rely on human experts to\ndefine features and often miss many vulnerabilities (i.e., incurring high false\nnegative rate). In this paper, we initiate the study of using deep\nlearning-based vulnerability detection to relieve human experts from the\ntedious and subjective task of manually defining features. Since deep learning\nis motivated to deal with problems that are very different from the problem of\nvulnerability detection, we need some guiding principles for applying deep\nlearning to vulnerability detection. In particular, we need to find\nrepresentations of software programs that are suitable for deep learning. For\nthis purpose, we propose using code gadgets to represent programs and then\ntransform them into vectors, where a code gadget is a number of (not\nnecessarily consecutive) lines of code that are semantically related to each\nother. This leads to the design and implementation of a deep learning-based\nvulnerability detection system, called Vulnerability Deep Pecker\n(VulDeePecker). In order to evaluate VulDeePecker, we present the first\nvulnerability dataset for deep learning approaches. Experimental results show\nthat VulDeePecker can achieve much fewer false negatives (with reasonable false\npositives) than other approaches. We further apply VulDeePecker to 3 software\nproducts (namely Xen, Seamonkey, and Libav) and detect 4 vulnerabilities, which\nare not reported in the National Vulnerability Database but were \"silently\"\npatched by the vendors when releasing later versions of these products; in\ncontrast, these vulnerabilities are almost entirely missed by the other\nvulnerability detection systems we experimented with.","url_abs":"http://arxiv.org/abs/1801.01681v1","url_pdf":"http://arxiv.org/pdf/1801.01681v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"vuldeepecker-a-deep-learning-based-system-for","repo_url":"https://github.com/CGCL-codes/VulDeePecker","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"none","reach":{"status":"ok","spdx":"Apache-2.0"}},{"paper_slug":"vuldeepecker-a-deep-learning-based-system-for","repo_url":"https://github.com/fanbyprinciple/Machine-Learning-For-Cyber-Security","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"unanswered"}},{"paper_slug":"vuldeepecker-a-deep-learning-based-system-for","repo_url":"https://github.com/johnb110/vdpython","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"none","reach":{"status":"unanswered"}},{"paper_slug":"vuldeepecker-a-deep-learning-based-system-for","repo_url":"https://github.com/messi-q/rechecker","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":null},{"paper_slug":"vuldeepecker-a-deep-learning-based-system-for","repo_url":"https://github.com/dascimal-org/MDSeqVAE/blob/master/VulDeePeck.py","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":0,"framework":"tf","reach":{"status":"unanswered"}}],"tasks":[{"task_slug":"deep-learning","task_name":"Deep Learning"},{"task_slug":"vulnerability-detection","task_name":"Vulnerability Detection"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/1801.01681","atlas_url":"https://app.syntology.ai/?focus=1801.01681","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"1801.01681"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/johnb110/vdpython","reach":{"status":"unanswered"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/messi-q/rechecker","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/dascimal-org/MDSeqVAE/blob/master/VulDeePeck.py","reach":{"status":"unanswered"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/fanbyprinciple/Machine-Learning-For-Cyber-Security","reach":{"status":"unanswered"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/CGCL-codes/VulDeePecker","reach":{"status":"ok","spdx":"Apache-2.0"}}],"summary":{"unverified":1},"by_repo_kind":{"listed":{"samples":1,"ran":0,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"f6f1cc3ce83a4096","entry":"read_label","repo":"messi-q/rechecker","repo_kind":"listed","path":"evaluations/reentrancy/Performance_evaluation.py","file_url":"https://github.com/messi-q/rechecker/blob/HEAD/evaluations/reentrancy/Performance_evaluation.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f6f1cc3ce83a4096"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}