Deep Learning-based Software Vulnerability Severity Prediction Using Natural Language Processing

Optimization of software vulnerability detection model based on machine learning algorithm

Enhancing Vulnerability Detection Precision through Ensemble Learning with Large Language Models

This study investigates the use of ensemble learning with Large Language Models (LLMs) to improve the accuracy of software vulnerability prediction, following a structured experimental approach to assess whether combining multiple models can enhance performance. Three baseline models, CodeBERT, GraphCodeBERT, and CodeT5, were trained and assessed on the Devign dataset, which provides a large collection of labeled source code snippets. Their outputs were then integrated using three ensemble techniques: Majority Voting, Weighted Voting, and Stacking. Precision, recall, and F1-score metrics were used to gauge performance. Ensemble approaches outperformed all standalone models. In particular, Majority Voting increased precision from 0.601 (CodeBERT) to 0.690, representing a 14.81% improvement. Keeping in view the detection accuracy, this study focused on reducing the false positives. The results show that the ensemble techniques are a practical approach to boost the precision of LLMs in the detection of vulnerabilities. Ensemble learning can address the challenges faced by standalone models by reducing false positives and improving the overall trade-off between accuracy and reliability. The study suggests that ensemble methods offer great potential in the advancement of software security analysis.

Predicting Temporal Exploitation of Software Vulnerabilities Using Knowledge-Fused Neural Learning

Despite over 25,000 Common Vulnerabilities and Exposures (CVEs) being disclosed annually, fewer than 5% are exploited in real attacks, making vulnerability prioritization a persistent challenge. Existing methods, including the Common Vulnerability Scoring System (CVSS) and Exploit Prediction Scoring System (EPSS), treat exploitation prediction as binary classification, discarding the temporal dimension that determines whether a patch needs deployment today, next month, or later. This study presents a knowledge-fused neural framework that reformulates this as a five-class temporal classification: 0–7 days, 8–30 days, 31–90 days, 91–365 days, and never exploited. The framework constructs a cybersecurity knowledge graph that integrates 1,003 Common Weakness Enumeration (CWE) definitions and 559 Common Attack Pattern Enumeration and Classification (CAPEC) attack patterns, with 5,070 relationships. Graph embeddings from Node2Vec are fused with Bidirectional Encoder Representations from Transformers (BERT) vulnerability embeddings via cross-attention. Evaluated on 102,000+ CVEs (2002–2024), the framework achieves 78.4% temporal classification accuracy, 74.7% exploitation F1-score, and 89.1% Area Under the Receiver Operating Characteristic curve (AUC-ROC)—outperforming EPSS by 6.8 F1 points. Ablation studies confirm that knowledge graph integration with cross-attention fusion is the critical architectural contribution.

Cross-platform software vulnerability detection using Vulnerascope-X with Word2Vec Node2Vec and RCGO optimized SVM

To increase program dependability and reduce maintenance expenses, software defect prediction is essential. For software vulnerability study across platforms, this paper presents a state-of-the-art methodology that makes use of a unique synthetic dataset called VulneraScope-X. Utilising synthetic CVE intelligence, this dataset incorporates a wealth of static, syntactic, and semantic information. This work employs an array of pre-processing methods, such as min-max normalisation, Word2Vec, Node2Vec, Synthetic Minority Oversampling Technique (SMOTE) for class balance, to deal with complexity and diversity of the features. The recently suggested Running City Game Optimiser (RCGO) outperformed state-of-the-art metaheuristics in feature selection while simultaneously lowering dimensionality and keeping predictive characteristics. With help of the features that were chosen, a Support Vector Machine (SVM) classifier was trained. The hyperparameters of this classifier were adjusted using Grid Search. Outperforming more conventional classifiers like Naive Bayes, MLP, and KNN, the model produced remarkable results with a 94.25% accuracy rate, 93.90% precision rate, 94.10% recall rate, and AUC-ROC of 0.962. In terms of accuracy and execution time, the RCGO algorithm outperformed other optimisation algorithms such as GA, GWO, CRO, and BWO. This scheme provides reproducible and scalable methodologies for software security evaluation in addition to demonstrating a high-performing pipeline for defect prediction. According to the findings, VulneraScope-X greatly improve cross-platform defect detection when combined with topological and semantic embeddings. When applied to large-scale, heterogeneous software organizations, this method demonstrates promise for vulnerability triaging and safe software development.

INTELLIGENT BUG PREDICTION SYSTEM

The intelligent bug prediction system addresses the main problem of identifying the defect-prone software modules in the early stages of the software development life cycle. The conventional testing methodologies are time-consuming and costly and do not provide an effective way to prioritise high-risk modules. This problem is important for improving software reliability, reducing maintenance cost and improving the overall quality of software systems. The current bug prediction techniques mainly rely on traditional machine learning models such as Random Forests, Support Vector Machines (SVMs), and Neural Networks, but they face challenges such as imbalanced data, limited feature sets, low interpretability, and binary predictions that do not provide meaningful guidance for testing prioritisation.In our approach, we propose an intelligent machine learning-based bug prediction framework that uses SMOTE for dataset balancing and feature selection to identify the most relevant software metrics. We also use advanced ensemble learning techniques, such as CatBoost, LightGBM, and the Stacking Ensemble model, to improve prediction accuracy. Methodology: Analysed software metrics from NASA MDP evaluated model performance using Accuracy, Precision, Recall, F1-score, ROC-AUC, and Confusion Matrix; and applied SHAP (SHapley Additive Explanations) to provide transparent and interpretable predictions. A Risk Scoring Mechanism categorises software modules as Stable, High, Medium, or Low risk, and Bug Fix Recommendations help developers more effectively fix predicted defects.The proposed system is expected to produce accurate, explainable, and risk-aware bug predictions. This enables developers to prioritise testing efforts, optimise resource allocation, cut debugging costs, and deliver more dependable, secure, and high-quality software.

A deep learning framework for vulnerability detection in open-source repositories using code embeddings