Application security is an essential part of developing modern software, as
lots of attacks depend on vulnerabilities in software. The number of attacks is
increasing globally due to technological advancements. Companies must include
security in every stage of developing, testing, and deploying their software in
order to prevent data breaches. There are several methods to detect software
vulnerability Non-AI-based such as Static Application Security Testing (SAST)
and Dynamic Application Security Testing (DAST). However, these approaches have
substantial false-positive and false-negative rates. On the other side,
researchers have been interested in developing an AI-based vulnerability
detection system employing deep learning models like BERT, BLSTM, etc. In this
paper, we proposed a two-stage solution, two deep learning models were proposed
for vulnerability detection in C/C++ source codes, the first stage is CNN which
detects if the source code contains any vulnerability (binary classification
model) and the second stage is CNN-LTSM that classifies this vulnerability into
a class of 50 different types of vulnerabilities (multiclass classification
model). Experiments were done on SySeVR dataset. Results show an accuracy of
99% for the first and 98% for the second stage.

本文提出了一个两阶段解决方案，第一阶段采用 CNN 检测源代码是否存在漏洞（二元分类模型），第二阶段采用 CNN-LTSM 将漏洞分类为 50 种不同的漏洞类型（多类分类模型），并针对 SySeVR 数据集进行实验，结果表明第一和第二阶段的准确性分别达到 99% 和 98%。