Developing automated and smart software vulnerability detection models has
been receiving great attention from both research and development communities.
One of the biggest challenges in this area is the lack of code samples for all
different programming languages. In this study, we address this issue by
proposing a transfer learning technique to leverage available datasets and
generate a model to detect common vulnerabilities in different programming
languages. We use C source code samples to train a Convolutional Neural Network
(CNN) model, then, we use Java source code samples to adopt and evaluate the
learned model. We use code samples from two benchmark datasets: NIST Software
Assurance Reference Dataset (SARD) and Draper VDISC dataset. The results show
that proposed model detects vulnerabilities in both C and Java codes with
average recall of 72\%. Additionally, we employ explainable AI to investigate
how much each feature contributes to the knowledge transfer mechanisms between
C and Java in the proposed model.

使用转移学习技术，提出了一种智能自动软件漏洞检测模型，通过使用各种编程语言的代码样本训练卷积神经网络（CNN）模型，并使用可解释人工智能，成功检测出 C 和 Java 代码中的常见漏洞。