Aug 2026· International Journal of Creative and Open Research in Engineering and Management· 0 citations
TL;DR
Experimental results show that AST-based structural features substantially improve recall compared with the TF-IDF baseline, while the combined TF-IDF and AST representation maintains this improved performance.
Abstract
The proliferation of software security vulnerabilities in modern applications has created an urgent demand for automated, intelligent, and scalable detection systems. Existing rule-based static analysis tools are effective for predefined vulnerability patterns but may have difficulty with variations that are not adequately covered by their rules, and a substantial portion of existing machine-learning-based vulnerability detection research focuses on C and C++ programs, while Python-specific approaches remain comparatively less explored. This paper presents a static code analysis framework for automated security vulnerability detection specifically targeting Python source code. The proposed framework implements a three-phase experimental pipeline: Phase 1 establishes a token-based TF-IDF baseline by representing source code as typed token pairs and training classical machine learning classifiers; Phase 2 introduces up to 35 hand-engineered structural features extracted from the Abstract Syntax Tree (AST) of each code snippet using the NodeVisitor design pattern; and Phase 3 combines both feature types into a unified representation and retrains all classifiers — Random Forest, Gradient Boosting, Logistic Regression, and Support Vector Machine. The system is trained and evaluated on a manually constructed, balanced dataset of 70 Python code snippets covering five high-severity CWE vulnerability categories: SQL Injection (CWE-89), OS Command Injection (CWE-78), Path Traversal (CWE-22), Insecure Deserialization (CWE-502), and Cross-Site Scripting (CWE-79). Recall is designated as the primary optimization metric because missed vulnerabilities carry greater risk than false alarms in security-critical deployment contexts. Experimental results show that AST-based structural features substantially improve recall compared with the TF-IDF baseline, while the combined TF-IDF and AST representation maintains this improved performance. The complete system is deployed as a command-line prediction tool producing a binary verdict, a continuous risk score, and a structured report of detected dangerous API patterns, and runs entirely on standard consumer hardware without GPU or deep-learning infrastructure requirements.
Vulnerability detection via static analysis traditionally relies on security experts encoding insecure coding patterns into algorithmic rules. However, this approach often focuses on syntactic patterns and overlooks deeper semantic information in the code, such as the meanings of variable and function names. As software systems grow more complex, modeling vulnerabilities using only syntactic rules becomes increasingly challenging. In this paper, we propose a semantics-aware approach to detecting software vulnerabilities. We present SETYPE, a semantics-aware type system that can be derived directly from source code based solely on the meanings of symbols and expressions in natural language. In the SETYPE type system, both type inference and checking are performed by Large Language Models (LLMs), and a failed type check indicates a potential vulnerability. We prototype PYSETYPE to demonstrate the feasibility of SETYPE for detecting vulnerabilities in Python web applications. Our evaluation on real-world applications achieves 87% detection precision and 88% detection accuracy. Using PYSETYPE, we identified 15 potential zero-day vulnerabilities, nine of which were confirmed by developers.
ABSTRACT
Python-based web application developed to identify and analyse malicious Android APK files. It integrates static analysis, using Andro guard to extract permissions and metadata, with dynamic analysis, employing Mobs to monitor runtime behaviour in a controlled sandbox environment. This dual-layered approach enables the detection of both overt and hidden threats. At its core, the system leverages a Random Forest classifier trained on labelled datasets of malware and benign applications, providing accurate threat classification along with confidence scoring. The application features a Flask-based web interface that allows secure APK uploads, real-time scanning, and the generation of detailed PDF reports. A history of previous scans is maintained to support long-term tracking and analysis. The technical architecture consists of three main components: a user interface built with HTML, CSS, and Flask templates; a Python backend responsible for feature extraction, safe testing, and machine learning predictions; and an SQLite database for storing results. By automating the identification of dangerous applications, the system addresses critical mobile security challenges. It is designed with scalability in mind, making it easy to expand for future needs such as cloud integration. Built with Python’s security tools and thoroughly tested, the project demonstrates a practical solution to combat evolving Android malware. It ensures usability for both programmers and security experts, combining technical rigor with accessibility. Ultimately, the Android Malware Detection System provides a comprehensive, reliable, and user-friendly platform to safeguard mobile ecosystems against emerging threats.
G. Vamsi, Vedula Sai Vinay· International Scientific Jou...· 1 citation
: As modern software systems grow in complexity, the number of vulnerabilities has grown rapidly, rendering traditional security strategies—including manual code reviews and rule-based static analyzers—increasingly resource-intensive and unable to keep pace with emerging threats. This paper presents a hybrid pipeline combining static vulnerability candidate selection using Latent Semantic Analysis with dynamic verification through Large Language Model-assisted fuzzing. The approach identifies semantically similar code patterns to known vulnerabilities without exact syntactic matches, and automates the generation of fuzzing harnesses and seed inputs to overcome coverage plateaus. We evaluate our pipeline on real-world C libraries (LibTIFF, libexpat, FreeType) with documented vulnerabilities. Results demonstrate that vulnerability candidates are ranked within the Top 3–8% of all functions, and model-generated artifacts yield a 5-fold speedup over random fuzzing. The LLM Gemini 3 Pro achieves the highest harness generation success rate at 83% (Pass@3). Our analysis reveals fundamental limitations: the mixed-vector problem dilutes vulnerability signals in multifunctional code, safety alignment mechanisms can inadvertently neutralize vulnerabilities through defensive code insertion, and static feature extraction without build context achieves only 19.93% recall. The pipeline reduces manual effort while still requiring human validation.
Kevin Nguyen, Dominik Schoop· Proceedings of the 23rd Inte...· 0 citations