English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Tools annual

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Tools monthly

Global: Zendy Plus monthly

Presents the access of premium content as premium feature

Premium Content

Global: Zendy Plus annual

Global: Zendy Free Plan

Automatically locating vulnerable statements in source code is crucial toassure software security and alleviate developers' debugging efforts. Thisbecomes even more important in today's software ecosystem, where vulnerablecode can flow easily and unwittingly within and across software repositorieslike GitHub. Across such millions of lines of code, traditional static anddynamic approaches struggle to scale. Although existing machine-learning-basedapproaches look promising in such a setting, most work detects vulnerable codeat a higher granularity -- at the method or file level. Thus, developers stillneed to inspect a significant amount of code to locate the vulnerablestatement(s) that need to be fixed.  This paper presents VELVET, a novel ensemble learning approach to locatevulnerable statements. Our model combines graph-based and sequence-based neuralnetworks to successfully capture the local and global context of a programgraph and effectively understand code semantics and vulnerable patterns. Tostudy VELVET's effectiveness, we use an off-the-shelf synthetic dataset and arecently published real-world dataset. In the static analysis setting, wherevulnerable functions are not detected in advance, VELVET achieves 4.5x betterperformance than the baseline static analyzers on the real-world data. For theisolated vulnerability localization task, where we assume the vulnerability ofa function is known while the specific vulnerable statement is unknown, wecompare VELVET with several neural networks that also attend to local andglobal context of code. VELVET achieves 99.6% and 43.6% top-1 accuracy oversynthetic data and real-world data, respectively, outperforming the baselinedeep-learning models by 5.3-29.0%.

VELVET: a noVel Ensemble Learning approach to automatically locate VulnErable sTatements