Vulnerability detection is critical in the overall process of managing software vulnerabilities [11]. It comprises detecting possible security weaknesses in software systems that attackers may exploit. There are several traditional techniques commonly used for vulnerability detection. In the manual code auditing method, human experts examine the source thoroughly to manually detect coding flaws, unsafe procedures, and possible vulnerabilities. Static analysis [35] involves using automated tools to analyze the source code or compiled binaries without executing the software under test. The goal of dynamic analysis [67, 102] is to evaluate the behavior of software while it is running. Running the software in a controlled environment or through automated tests while monitoring its execution and interactions with system resources is what it entails. However, dynamic analysis may have constraints in terms of significant system overhead [167]. One approach that falls under this category is the usage of fuzz testing for software vulnerability detection [42]. In fuzz testing, the input space for the program under test is identified, then the inputs are modified/mutated randomly or based on a set of already-defined rules to generate malformed inputs as well as boundary input values (i.e., edge cases). These tainted values are expected to hit parts of the program under test that are not properly validated, which results in serious security vulnerabilities like denial of service or remote code execution. Hybrid code analysis [25] is a strong approach that combines the benefits of static and dynamic analysis to increase the effectiveness of software vulnerability detection. Static analysis examines code without executing it. Its key strength is its ability to quickly scan the entire codebase and identify any flaws before the code executes. Yet, it often generates high false positives and has limited context on runtime behavior [52]. Dynamic analysis, however, involves running the code and monitoring its behavior in a real-time fashion. This method excels at finding runtime issues such as memory leaks.² Yet, the main drawback is that it is resource intensive, as you need to run the entire program under test to explore different code patches.
漏洞检测在软件漏洞管理整体过程中至关重要[11]。它包括检测软件系统中攻击者可能利用的安全弱点。用于漏洞检测的传统技术有几种。在手动代码审计方法中，专家会彻底检查源代码，以手动检测编码缺陷、不安全程序和可能存在的漏洞。静态分析[35]涉及使用自动化工具分析源代码或编译的二进制文件，而无需执行测试软件。动态分析[67, 102]的目标是评估软件在运行时的行为。这包括在受控环境中运行软件或通过自动化测试，同时监控其执行和与系统资源的交互。然而，动态分析可能在系统开销方面存在限制[167]。这一类别下的一个方法是使用模糊测试进行软件漏洞检测[42]。 模糊测试中，确定了待测程序的输入空间，然后随机修改/变异输入或基于一组已定义的规则生成格式不正确的输入以及边界输入值（即边缘情况）。这些受污染的值预计会击中程序中未正确验证的部分，从而导致严重的安全漏洞，如拒绝服务或远程代码执行。混合代码分析[25]是一种强大的方法，它结合了静态分析和动态分析的优势，以提高软件漏洞检测的有效性。静态分析在不执行代码的情况下检查代码。其关键优势是能够快速扫描整个代码库并在代码执行之前识别任何缺陷。然而，它通常会产生大量的误报，并且对运行时行为的上下文有限[52]。然而，动态分析涉及运行代码并以实时方式监控其行为。这种方法擅长发现运行时问题，如内存泄漏。 然而，主要缺点是它资源密集，因为你需要运行整个待测试程序来探索不同的代码补丁。

The hybrid model leverages the strengths of both approaches to ensure comprehensive coverage. Despite its benefits, implementing hybrid code analysis has technical complexities, such as integrating and synchronizing static and dynamic tools. Additionally, it demands significant computational resources and time, potentially slowing down development time.
混合模型利用两种方法的优势以确保全面覆盖。尽管具有这些优点，实施混合代码分析存在技术复杂性，例如集成和同步静态和动态工具。此外，它需要大量的计算资源和时间，可能会减缓开发时间。

After the detection of vulnerabilities, the subsequent step in software vulnerability management is vulnerability analysis and assessment [130]. This step involves a further examination of identified vulnerabilities to assess their severity, impact, and potential exploitability. First, with regard to severity, accurately assessing software vulnerabilities is vital for several reasons. One reason is that it allows organizations to prioritize their response based on the severity of the vulnerabilities. Severity refers to the potential impact a vulnerability could have if exploited [15]. By accurately assessing the severity, organizations can focus their attention on high-severity vulnerabilities that pose significant threats to the security and functionality of the software system. Second, with regard to impact, accurately assessing vulnerabilities helps determine the potential impact they may have on the organization [43]. The term impact refers to the manifestations of exploiting a vulnerability, such as denial of service [53] or data breaches. By understanding the potential impact, organizations can make informed decisions regarding the urgency and priority of remediation efforts. Third, with regard to exploitability, accurate vulnerability assessment aids in understanding their potential exploitability [14]. This entails determining the possibility that an attacker will be successful in exploiting the vulnerability to infiltrate the software system.
在漏洞检测之后，软件漏洞管理的下一步是漏洞分析和评估[130]。这一步骤包括对已识别的漏洞进行进一步审查，以评估其严重性、影响和潜在的利用性。首先，关于严重性，准确评估软件漏洞至关重要，原因有几个。其中一个原因是它允许组织根据漏洞的严重性来优先处理响应。严重性指的是漏洞被利用时可能产生的潜在影响[15]。通过准确评估严重性，组织可以集中精力关注那些对软件系统安全和功能构成重大威胁的高严重性漏洞。其次，关于影响，准确评估漏洞有助于确定它们可能对组织产生的潜在影响[43]。影响一词指的是利用漏洞的表现，如拒绝服务[53]或数据泄露。 通过理解潜在影响，组织可以就修复努力的紧迫性和优先级做出明智的决策。第三，关于可利用性，准确的安全漏洞评估有助于理解其潜在的利用性[14]。这包括确定攻击者成功利用漏洞渗透软件系统的可能性。

The process of resolving detected software vulnerabilities by different techniques such as patching, code modification, and repairing is referred to as software vulnerability remediation [59]. The fundamental goal of remediation is to eliminate or mitigate vulnerabilities to improve the security and dependability of the software system. One common approach to vulnerability remediation is applying patches provided by software vendors or open source communities [156]. Patches are updates or fixes that address specific vulnerabilities or weaknesses identified in a software system.
软件漏洞的解决过程，通过修补、代码修改和修复等不同技术手段，被称为软件漏洞修复[59]。修复的基本目标是消除或减轻漏洞，以提高软件系统的安全性和可靠性。一种常见的漏洞修复方法是应用软件供应商或开源社区提供的补丁[156]。补丁是针对软件系统中识别出的特定漏洞或弱点的更新或修复。

By utilizing data analysis, pattern recognition, and ML to find software security vulnerabilities, ML approaches have revolutionized software vulnerability detection [145]. These techniques improve the accuracy and efficiency of vulnerability detection, potentially allowing automated detection, faster analysis, and the identification of previously undisclosed vulnerabilities. One common application of ML in vulnerability detection is the classification of code snippets [27], software binaries, or code changes extracted from open source repositories such as GitHub or Common Vulnerability and Exposure (CVE). ML models can be trained on labeled datasets, where each sample represents a known vulnerability or non-vulnerability. These models then learn to generalize from the provided examples and classify new instances based on the patterns they have learned. This method allows for automatic vulnerability discovery without the need for manual examination, considerably lowering the time and effort necessary for analysis.
通过利用数据分析、模式识别和机器学习来发现软件安全漏洞，机器学习方法已经彻底改变了软件漏洞检测[145]。这些技术提高了漏洞检测的准确性和效率，可能实现自动化检测、快速分析和识别之前未公开的漏洞。机器学习在漏洞检测中的一个常见应用是对代码片段[27]、软件二进制文件或从 GitHub 或通用漏洞和暴露（CVE）等开源存储库中提取的代码更改进行分类。这些模型可以在标记数据集上进行训练，其中每个样本代表一个已知的漏洞或非漏洞。然后，这些模型从提供的示例中学习，并根据它们学到的模式对新实例进行分类。这种方法允许自动发现漏洞，无需手动检查，大大降低了分析所需的时间和精力。

ML models for detecting software vulnerabilities have promising advantages over traditional methodologies. Each benefit is discussed in detail in the next paragraph. Automation is a significant advantage. ML models can automatically scan and analyze large codebases, or system configurations, detecting potential vulnerabilities without requiring human intervention for each case [12]. This automation speeds up the detection process, allowing security teams to focus on verifying and mitigating vulnerabilities rather than manual analysis. With regard to efficiency and scalability, ML approaches offer faster analysis. Traditional vulnerability detection techniques rely on manual inspection or the application of pre-defined rules [128]. In contrast, ML approaches can evaluate enormous volumes of data in parallel and generate predictions quickly, dramatically shortening the time necessary to find vulnerabilities. With regard to detection effectiveness, ML models can uncover previously unknown vulnerabilities, commonly known as zero-day vulnerabilities [5]. These models may uncover signs of vulnerabilities even when they have not been specifically trained on them by learning patterns and generalizing from labeled data. This capability improves the overall security by helping to identify and address unknown weaknesses in software before they are exploited by attackers [1].
机器学习模型在检测软件漏洞方面相较于传统方法具有显著优势。每个优势将在下一段详细讨论。自动化是一个重要优势。机器学习模型可以自动扫描和分析大型代码库或系统配置，检测潜在漏洞，无需对每个案例进行人工干预[12]。这种自动化加快了检测过程，使安全团队能够专注于验证和缓解漏洞，而不是手动分析。在效率和可扩展性方面，机器学习方法提供了更快的分析。传统的漏洞检测技术依赖于人工检查或应用预定义的规则[128]。相比之下，机器学习方法可以并行评估大量数据并快速生成预测，显著缩短发现漏洞所需的时间。在检测有效性方面，机器学习模型可以揭示之前未知的漏洞，通常称为零日漏洞[5]。 这些模型甚至在没有针对它们进行特定训练的情况下，通过学习模式和从标记数据中泛化，也可能发现漏洞的迹象。这种能力通过帮助在攻击者利用之前识别和解决软件中的未知弱点，从而提高了整体安全性[1]。

Figure 1 shows the overall pipeline of software vulnerability detection. The pipeline for software vulnerability detection using ML models involves several key stages.
图 1 展示了软件漏洞检测的整体流程。使用机器学习模型进行软件漏洞检测的流程包括几个关键阶段。

The first stage is data collection, where data is gathered from various sources such as benchmark datasets including but not limited to the National Vulnerability Database (NVD) and the National Institute of Standards and Technology (NIST) Software Assurance Reference Dataset (SARD), code repositories (GitHub), and specific open source projects (LibTIFF, FFMPEG).
第一阶段是数据收集，数据来自各种来源，包括但不限于国家漏洞数据库（NVD）和国家标准与技术研究院（NIST）软件保证参考数据集（SARD），代码仓库（GitHub），以及特定的开源项目（LibTIFF，FFMPEG）。

The data preprocessing stage involves tokenization, parsing (using tools like Joern,³) normalization, and feature extraction to convert raw code into analyzable formats.
数据预处理阶段包括分词、解析（使用如 Joern、 ³ 等工具）、归一化和特征提取，以将原始代码转换为可分析格式。

The data representation stage is where the preprocessed data is converted into appropriate representations, including graph-based representations such as control flow or dataflow graphs, token representations, or numerical attributes.
数据表示阶段是将预处理后的数据转换为适当的表示，包括基于图的表示，如控制流图或数据流图，标记表示或数值属性。

In the feature extraction stage, once the data is represented in an appropriate form, these representations are converted into suitable features using different embedding techniques such as graph embedding or token vector embedding.
在特征提取阶段，一旦数据以适当的形式表示，这些表示就通过不同的嵌入技术（如图嵌入或标记向量嵌入）转换为合适的特征。

In the model inference stage, appropriate DL models (e.g., Recurrent Neural Networks (RNNs), Graph Neural Networks (GNNs), Transformers, Autoencoders, and Deep Belief Networks (DBNs)), as well as traditional ML models (e.g., Support Vector Machines (SVMs), Decision Trees, and Random Forests), are chosen based on the characteristics of the data. The training process includes splitting the data into training and test sets, feature engineering, hyperparameter tuning, and applying suitable training algorithms.
在模型推理阶段，根据数据特征选择合适的深度学习模型（例如，循环神经网络（RNNs）、图神经网络（GNNs）、Transformer、自编码器和深度信念网络（DBNs）），以及传统的机器学习模型（例如，支持向量机（SVMs）、决策树和随机森林）。训练过程包括将数据分为训练集和测试集、特征工程、超参数调整以及应用合适的训练算法。

In addition, model evaluation is often conducted using cross validation, performance metrics (i.e., accuracy, precision, and recall), confusion matrices, and ablation studies to ensure robust performance. This step ensures the models are accurate and reliable for detecting software vulnerabilities.
此外，模型评估通常采用交叉验证、性能指标（即准确率、精确率和召回率）、混淆矩阵和消融研究来确保稳健的性能。这一步骤确保模型在检测软件漏洞方面准确可靠。

In this stage, we filter studies based on their titles. Since titles do not convey much information about the subject study, we only focused on relevance to the initial keywords. In this stage, we answer the following question: Do the titles contain specific keywords or phrases that are central to software vulnerability detection? For example, in the study titled “Toward Hardware-Based IP Vulnerability Detection and Post-Deployment Patching in Systems-on-Chip,” although the title includes our devised keyword vulnerability detection, the context indicates that the focus is on hardware and systems-on-chip rather than software engineering.
在这个阶段，我们根据研究标题进行筛选。由于标题并不能传达太多关于研究主题的信息，我们只关注与初始关键词的相关性。在这个阶段，我们回答以下问题：标题中是否包含与软件漏洞检测相关的特定关键词或短语？例如，在标题为“面向基于硬件的 IP 漏洞检测和片上系统部署后补丁的解决方案”的研究中，尽管标题中包含了我们设计的“漏洞检测”关键词，但上下文表明，重点是硬件和片上系统，而不是软件工程。

After the manual analysis on approximately 15K records, we collected 398 unique studies for further evaluation.
在手动分析约 15K 条记录之后，我们收集了 398 个独特的研究进行进一步评估。

Abstract Filtering Stage. Given the list of studies filtered from the previous stage, we thoroughly analyzed the abstract of the studies. We decomposed the abstract of each paper into four major sections, including Context, Objective, Approach, and Results/Findings, as abstracts of research papers often follow such structure.
摘要筛选阶段。给定从上一阶段筛选出的研究列表，我们对研究的摘要进行了全面分析。我们将每篇论文的摘要分解为四个主要部分，包括背景、目标、方法和结果/发现，因为研究论文的摘要通常遵循这种结构。

In this stage of filtering, we get 202 unique papers for further verification.
在这个筛选阶段，我们获得了 202 篇独特的论文以供进一步验证。

Content Filtering Stage. In this section, we analyze the content of each study in detail to perform the filtering process. Since there is more detail in the actual content of each study, we devise a set of criteria questions. We rely on the answers to these questions to assess the quality of the papers. If the answers to these questions are positive, the study is relevant; otherwise, we remove the paper from further examination. The questions are as follows: (1) Is there a clearly stated research goal related to software vulnerability detection in the introduction of the paper?; (2) Does the proposed vulnerability detection approach use ML or DL techniques?; (3) Is there a defined and repeatable technique?; (4) Is there any explicit contribution to software vulnerability detection?; (5) Is there a clear methodology for validating the technique?; (6) Are the subject projects selected for validation suitable for the research goals?; (7) Are the employed datasets relevant to software vulnerability detection?; (8) Are the type of input data to DL and ML models relevant to software vulnerability detection? (valid data types include source code, binary code, text, and commit metrics); (9) Are there control techniques or baselines to demonstrate the effectiveness of the software vulnerability detection technique?; (10) Are the evaluation metrics relevant (e.g., evaluate the effectiveness of the proposed technique) to the research objectives?; and (11) Do the results presented in the study align with the research objectives, and are they presented in a clear and relevant manner?
内容过滤阶段。在本节中，我们详细分析每项研究的具体内容以执行过滤过程。由于每项研究的实际内容中包含更多细节，我们制定了一套标准问题。我们依靠对这些问题的回答来评估论文的质量。如果这些问题的回答是肯定的，则该研究相关；否则，我们将该论文从进一步审查中移除。问题如下：（1）论文引言中是否明确提出了与软件漏洞检测相关的明确研究目标？（2）所提出的漏洞检测方法是否使用了机器学习或深度学习技术？（3）是否存在定义明确且可重复的技术？（4）是否对软件漏洞检测有明确的贡献？（5）是否有验证技术的明确方法？（6）所选用于验证的项目主题是否适合研究目标？（7）所使用的数据集是否与软件漏洞检测相关？（8）深度学习和机器学习模型的输入数据类型是否与软件漏洞检测相关？ (有效数据类型包括源代码、二进制代码、文本和提交指标)；（9）是否存在控制技术或基线来证明软件漏洞检测技术的有效性？；（10）评估指标是否与研究目标相关（例如，评估所提出技术的有效性）？；（11）研究中呈现的结果是否与研究目标一致，并且是否以清晰和相关的形式呈现？

The filtering process in this stage resulted in 138 subject studies to address the RQs. We used these 138 studies to create taxonomies which are explained in detail in the next section.
本阶段的筛选过程产生了 138 项主题研究以解决 RQs。我们利用这 138 项研究创建了分类法，将在下一节中详细解释。

Figure 3 demonstrates the publication trend of software vulnerability detection studies published over 13 years (i.e., between January 2011 and June 2024). It is observable that the number of publications has gradually increased over the years.
图 3 展示了过去 13 年（即 2011 年 1 月至 2024 年 6 月）发表的软件漏洞检测研究出版趋势。观察可知，出版物数量逐年逐渐增加。

We also analyze the cumulative number of publications shown in Figure 3. It is noticeable that the curve fitting the distribution shows a significant increase in slope between 2020 and 2024, suggesting that the usage of ML techniques for software vulnerability detection has become a prevalent trend since 2020.
我们同时分析了图 3 中显示的出版物累积数量。值得注意的是，拟合分布的曲线在 2020 年至 2024 年之间斜率显著增加，表明自 2020 年以来，使用机器学习技术进行软件漏洞检测已成为一种普遍趋势。

In this study, in general, we studied and reviewed 138 studies from various publication venues, including 61 studies from conferences and symposiums and 77 studies from journals. Table 2 shows the distribution of studies for each publication venue. A total of 44.2% of the publications are published in conferences and symposiums, whereas 55.7% of the studies have been published as articles in journals. It is observable that ICSE, ISSRE, MSR, and FSE are the most popular venues that have the highest number of studies. Meanwhile, among the journal venues, IST, C&S, and JSS have the highest number of studies—that is, 13, 12, and 12 studies, respectively.
在本研究中，总体而言，我们研究了并回顾了来自各种出版物场所的 138 项研究，包括来自会议和研讨会的 61 项研究以及来自期刊的 77 项研究。表 2 显示了每个出版物场所的研究分布。总共 44.2%的出版物是在会议和研讨会上发表的，而 55.7%的研究已作为文章发表在期刊上。可以观察到，ICSE、ISSRE、MSR 和 FSE 是最受欢迎的场所，拥有最多的研究数量。同时，在期刊场所中，IST、C&S 和 JSS 的研究数量最多，分别是 13 篇、12 篇和 12 篇。

One of the main challenges in ML-based software vulnerability detection is the insufficient amount of data available for model training [19, 88]. Consequently, there exists a gap in research on how to obtain sufficient datasets to facilitate the training of ML models for software vulnerability detection. To this end, we analyze the sources of datasets in the subject studies. Our analysis reveals that datasets for this purpose can be broadly classified into four categories: Benchmark, Hybrid, Open Source Software, and Repository sources. Among the subject studies, 39.1% of them use Hybrid as the data source for the detection of software vulnerability. They use a combination of various sources of data, such as benchmarks, repositories, and open source projects, to provide a comprehensive and multi-faceted resource for software vulnerability detection [36, 141]. These datasets combine the benefits of each data source to provide richer and more diversified information, which is critical for building and verifying robust vulnerability detection systems. Benchmark datasets used by 37.6% of the subject studies play a crucial role in the field of software vulnerability detection by providing standardized, high-quality data that researchers can use to evaluate and compare the effectiveness of their detection technique [127, 159]. Using benchmark datasets facilitates the construction of ML models for software vulnerability detection. However, they may not include zero-day vulnerabilities, which have a significant impact. Among the subject studies, 13.7% of them collect datasets from online repositories which we classify as the Repository category. These datasets are gathered from publicly available projects hosted on repository websites such as GitHub or Stack Overflow [28, 118, 184]. These repositories hold a plethora of data, including source code, commit history, issue trackers, and documentation. Repositories keep detailed records of any changes made to a codebase, such as commit messages, diffs, and timestamps [101]. This comprehensive history enables researchers to trace the lifecycle of vulnerabilities from introduction to resolution (please refer to the work of Iannone et al. [61]). The fourth source is open source software, accounting for 9.4% of the subject studies, which provides a rich and diverse source of data for software vulnerability detection [126, 163]. These projects are publicly accessible and typically have a large community of contributors who continuously update and maintain the code. Some example open source projects include but are not limited to FFmpeg, QEMU, OpenSSH, and LibTIFF. The open nature of these projects means that they are often inspected carefully by numerous developers, which can lead to the discovery and documentation of various vulnerabilities.
机器学习软件漏洞检测的主要挑战之一是模型训练所需数据的不足[19, 88]。因此，在如何获取足够的数据集以促进软件漏洞检测的机器学习模型训练方面的研究存在差距。为此，我们分析了该主题研究中数据集的来源。我们的分析表明，用于此目的的数据集可以大致分为四类：基准、混合、开源软件和存储库来源。在主题研究中，39.1%的研究使用混合作为软件漏洞检测的数据源。他们结合了各种数据来源，如基准、存储库和开源项目，为软件漏洞检测提供了一个全面和多角度的资源[36, 141]。这些数据集结合了每个数据来源的优点，提供了更丰富和更多样化的信息，这对于构建和验证稳健的漏洞检测系统至关重要。由 37.6% 的研究对象在软件漏洞检测领域发挥着关键作用，通过提供标准化的、高质量的数据，研究人员可以使用这些数据来评估和比较其检测技术的有效性[127, 159]。使用基准数据集有助于构建软件漏洞检测的机器学习模型。然而，它们可能不包括零日漏洞，这对影响很大。在研究对象中，13.7% 的研究收集来自在线存储库的数据集，我们将这类数据集归类为存储库类别。这些数据集来自 GitHub 或 Stack Overflow 等存储库网站上公开的项目[28, 118, 184]。这些存储库包含大量数据，包括源代码、提交历史、问题跟踪器和文档。存储库详细记录了代码库的任何更改，如提交信息、差异和时间戳[101]。这一全面的历史记录使研究人员能够追踪漏洞从引入到解决的生命周期（请参阅 Iannone 等人[61]的工作）。第四个来源是开源软件，占 9%。4% 的受试研究，为软件漏洞检测提供了丰富多样的数据来源[126, 163]。这些项目是公开可访问的，通常拥有庞大的贡献者社区，他们持续更新和维护代码。一些示例开源项目包括但不限于 FFmpeg、QEMU、OpenSSH 和 LibTIFF。这些项目的开放性意味着它们经常被众多开发者仔细检查，这可能导致各种漏洞的发现和记录。

Table 3 shows the detailed distribution of benchmark data used in the subject studies. As it is observable, SARD and NVD are the most widely used sources of data in the Benchmark category. SARD is a comprehensive set of test cases created exclusively for testing software systems. It was developed by NIST¹¹ as part of their efforts to improve the quality and safety of software systems. SARD offers a wide range of synthetic and real-world test scenarios intended to reflect many sorts of software vulnerabilities. Another major source of benchmark data is NVD, which is a comprehensive repository of publicly disclosed software vulnerabilities. NVD entries are based on the CVE system, which provides standardized identifiers and descriptions for each vulnerability. CVEs are assigned by CVE Numbering Authorities¹² and are a cornerstone of NVD. Each entry in NVD includes detailed information about the vulnerability, such as its description, severity (using the Common Vulnerability Scoring System), impacted software versions, references to related advisories, and mitigation advice. Smartbugs Wild¹³ is also the third most commonly used (accounting for 12 studies) dataset for software vulnerability detection within the field of smart contracts. Smartbugs Wild contains more than 47K smart contracts mined from the main network of Ethereum, which includes a wide variety of real-world smart contracts, providing a useful dataset for testing and assessing vulnerability detection techniques. Please note that the key factor confirming the validity of a benchmark dataset is its continuous updating. As the nature of vulnerabilities evolves and more zero-day vulnerabilities emerge, these datasets need to be updated to reflect the latest software vulnerability patterns. This is why researchers do not rely solely on benchmark data for building ML models.
表 3 显示了主题研究中使用的基准数据的详细分布。观察可知，SARD 和 NVD 是基准类别中最广泛使用的数据来源。SARD 是一套专为测试软件系统而创建的测试用例集合。它是作为 NIST ¹¹ 提高软件系统质量和安全性的努力之一而开发的。SARD 提供了一系列合成和现实世界的测试场景，旨在反映许多类型的软件漏洞。基准数据的另一个主要来源是 NVD，它是一个公开披露的软件漏洞的综合性存储库。NVD 条目基于 CVE 系统，该系统为每个漏洞提供标准化的标识符和描述。CVE 由 CVE 编号机构 ¹² 分配，是 NVD 的基石。NVD 中的每个条目都包含有关漏洞的详细信息，例如其描述、严重性（使用通用漏洞评分系统）、受影响的软件版本、相关警告的引用以及缓解建议。 Smartbugs Wild ¹³ 也是智能合约领域软件漏洞检测中第三常用的（占 12 项研究）数据集。Smartbugs Wild 包含从以太坊主网络挖掘的超过 47K 个智能合约，其中包括各种现实世界的智能合约，为测试和评估漏洞检测技术提供了有用的数据集。请注意，确认基准数据集有效性的关键因素是其持续更新。随着漏洞性质的变化和更多零日漏洞的出现，这些数据集需要更新以反映最新的软件漏洞模式。这就是为什么研究人员在构建机器学习模型时不仅仅依赖于基准数据。

Table 4 shows the detailed distribution of the Repository source of data. As shown, GitHub is the most popular source of data for software vulnerability detection, accounting for 27 subject studies. One benefit of utilizing GitHub as a data source is that it gives you access to real-world code written by developers, which can be used to train and test vulnerability detection models. The second commonly used source of repository data is the CVE system, which is a widely recognized and utilized framework for identifying, cataloging, and referencing publicly disclosed vulnerabilities. Each vulnerability in the CVE system is given a unique identification known as a CVE ID (e.g., CVE-2023-33976). This standardized identifier facilitates easy reference and communication across various platforms and tools. CVE entries provide detailed descriptions of vulnerabilities, outlining the nature of the issue, the affected software, and the potential impacts. The third commonly used source of repository data is Etherscan,¹⁴ a popular blockchain explorer for the Ethereum blockchain. Etherscan provides users with extensive information about Ethereum transactions, addresses, tokens, and smart contracts. It offers detailed insights into deployed smart contracts, including the contract’s source code (if verified), transactions, and execution history. Users can access the complete history of transactions involving a smart contract, with details about function calls, input parameters, and transaction results.
表 4 显示了数据存储库源的数据详细分布。如图所示，GitHub 是软件漏洞检测数据的最受欢迎来源，占 27 项研究。利用 GitHub 作为数据源的一个好处是，它为您提供了开发者编写的真实世界代码的访问权限，这些代码可用于训练和测试漏洞检测模型。第二个常用的存储库数据来源是 CVE 系统，这是一个广泛认可和使用的框架，用于识别、编目和引用公开披露的漏洞。CVE 系统中的每个漏洞都被赋予一个唯一的标识符，称为 CVE ID（例如，CVE-2023-33976）。这个标准化标识符促进了在各种平台和工具之间的轻松引用和沟通。CVE 条目提供了漏洞的详细描述，概述了问题的性质、受影响的软件和潜在影响。第三个常用的存储库数据来源是 Etherscan， ¹⁴ ，一个流行的以太坊区块链浏览器。 Etherscan 为用户提供关于以太坊交易、地址、代币和智能合约的详细信息。它提供了对已部署智能合约的详细洞察，包括合约的源代码（如果已验证）、交易和执行历史。用户可以访问涉及智能合约的所有交易的完整历史，包括函数调用、输入参数和交易结果。

When it comes to detecting software vulnerabilities, datasets can have varying data types. Existing software vulnerability detection models, for example, can find vulnerabilities in source code or commits. It is crucial to carefully examine these data types, as they require different preprocessing techniques and must be represented differently when using ML models. Additionally, distinct data types necessitate different architectural approaches for ML models. This section provides an overview of the various data types and their distributions. We classified the data types of the employed datasets into four broad categories: Code, Text, Numerical, and Hybrid.
在检测软件漏洞方面，数据集可以包含不同的数据类型。例如，现有的软件漏洞检测模型可以在源代码或提交中找到漏洞。仔细检查这些数据类型至关重要，因为它们需要不同的预处理技术，并且在使用机器学习模型时必须以不同的方式表示。此外，不同的数据类型需要为机器学习模型采用不同的架构方法。本节概述了各种数据类型及其分布。我们将所使用数据集的数据类型分为四大类：代码、文本、数值和混合。

The majority of the subject studies (92.7%) primarily focus on analyzing source code for software vulnerability detection, underscoring the importance of code-level analysis in identifying vulnerabilities. Repository-level data, such as textual reports and logs, account for 1.4%, whereas commit characteristics (numerical data) account for 2.8%. Additionally, 2.8% of the studies adopt a hybrid approach, combining both code-level analysis and repository-level data.
大多数研究对象（92.7%）主要关注分析源代码以检测软件漏洞，强调了在识别漏洞中代码级分析的重要性。仓库级数据（如文本报告和日志）占 1.4%，而提交特征（数值数据）占 2.8%。此外，2.8%的研究采用混合方法，结合了代码级分析和仓库级数据。

Table 5 elaborates on the detailed data type categories used in the subject studies. The table shows that 128 subject studies used a code-based category and the major data type of this category is Source code [34, 179]. Binary code is the second major data type in the code-based category [58, 117], accounting for 18 subject studies.
表 5 详细说明了在主题研究中使用的详细数据类型类别。表格显示，128 项主题研究使用了基于代码的类别，该类别的主要数据类型是源代码[34, 179]。二进制代码是基于代码类别的第二大主要数据类型[58, 117]，占 18 项主题研究。

As noted in earlier sections, research studies focusing on software vulnerability detection rely on diverse sources of data and data types. This variability urges the adoption of various representation strategies, architectural approaches, and design assumptions for ML models.
如前文所述，专注于软件漏洞检测的研究依赖于多种数据来源和数据类型。这种多样性促使采用各种表示策略、架构方法和设计假设来构建机器学习模型。

We classified the input representation of employed datasets into five broad categories: Graph, Token, Tree, Commit Metrics, and Hybrid. The most popular input representation is the use of Graph, accounting for 57.2% of the subject studies. Token follows closely, representing a substantial portion (24.6%) of the subject studies. Tree representation is the third most common approach, accounting for 11.5% of the subject studies. The Commit Metrics and Hybrid categories have the smallest portion, accounting for 2.8% and 2.1% of the subject studies, respectively. In the following paragraphs, we elaborate on each category in detail.
我们将所使用数据集的输入表示分为五大类：图、标记、树、提交指标和混合。最流行的输入表示是图的使用，占主题研究的 57.2%。标记紧随其后，代表主题研究的大比例（24.6%）。树表示是第三种最常见的方法，占主题研究的 11.5%。提交指标和混合类别所占比例最小，分别占主题研究的 2.8%和 2.1%。在接下来的段落中，我们将详细阐述每一类。

Graph/Tree-Based Representation [63, 126]. This type allows for the detection of complex patterns and relationships between different code elements. By representing source code as a graph or tree, we can capture not only the syntax and structure of the code but also its semantics, control flow, and dataflow. There are many graph/tree-based representation techniques, such as AST (Abstract Syntax Trees) [100, 161] and CPG (Code Property Graph) [34, 41, 183] used to transform source code into AST and CPG representations.
图/树状表示[63, 126]。这种类型允许检测不同代码元素之间的复杂模式和关系。通过将源代码表示为图或树，我们不仅可以捕获代码的语法和结构，还可以捕获其语义、控制流和数据流。有许多基于图/树的表示技术，例如 AST（抽象语法树）[100, 161]和 CPG（代码属性图）[34, 41, 183]，用于将源代码转换为 AST 和 CPG 表示。

Token-Based Representation [45, 140]. This typetreats the source code as string token sequences and then transforms source code into token vectors. The input data is first broken down into tokens, which are then turned into numerical vectors that can be processed by ML algorithms. Tokenization involves breaking down a string of text or source code into smaller units, or tokens, which can then be used as the basis for further analysis. In the case of source code, tokens might include keywords, operators, variables, and other elements of the programming language syntax.
基于标记的表示[45, 140]。这种类型将源代码视为字符串标记序列，然后将源代码转换为标记向量。首先将输入数据分解为标记，然后将这些标记转换为可以由机器学习算法处理的数值向量。标记化涉及将文本或源代码字符串分解为更小的单元，即标记，然后可以用作进一步分析的基础。在源代码的情况下，标记可能包括关键字、运算符、变量和编程语言语法的其他元素。

Commit Metrics [114, 115]. This type leverages the metrics extracted from commits to represent code commits. Commit-level features, such as the number of code changes, the number of modified lines, and the programming language used, can be used to train ML models. These models may then learn patterns and connections between commit attributes and the presence of vulnerabilities, allowing for automatic detection of new commits.
提交指标[114, 115]。此类方法利用从提交中提取的指标来表示代码提交。提交级别的特征，如代码更改数量、修改行数以及使用的编程语言，可以用于训练机器学习模型。这些模型可以学习提交属性与漏洞存在之间的模式和联系，从而实现新提交的自动检测。

Hybrid Representation [19, 30]. This type employs a variety of representations to discover software security vulnerabilities. Combining diverse representations of input data can result in a more comprehensive and richer input representation of source code, which can help vulnerability detection techniques perform better in tasks like prediction and detection.
混合表示法[19, 30]。此类方法采用多种表示法来发现软件安全漏洞。结合输入数据的多样化表示可以产生更全面、更丰富的源代码输入表示，这有助于漏洞检测技术在预测和检测等任务中表现更佳。

Table 6 shows the representation techniques distributed by different artifacts used by ML models. It is evident that Graph/Tree-based representation is the most prevalent technique, with a total of 96 studies employing this method. These studies represent the input to ML models using various forms: Source code as a graph, Source code as a tree, Binary code as a graph, and Binary code as a tree. Notably, Source code as a graph is the predominant representation technique, used by 71 studies. Furthermore, 33 subject studies employed Token-based representation. Among them, 23 studies represented source code as a token sequence, 9 studies modeled binary code as tokens, and 2 studies represented text as token sequences.
表 6 展示了机器学习模型使用的不同工具所分布的表示技术。显然，基于图/树表示是最普遍的技术，共有 96 项研究采用这种方法。这些研究使用各种形式将输入表示为机器学习模型：源代码作为图、源代码作为树、二进制代码作为图和二进制代码作为树。值得注意的是，源代码作为图是主要的表示技术，被 71 项研究使用。此外，33 项主题研究采用了基于标记的表示。其中，23 项研究将源代码表示为标记序列，9 项研究将二进制代码建模为标记，2 项研究将文本表示为标记序列。

Figure 4 shows the distribution of data type representation in software vulnerability detection studies over time. As shown in the figure, Graph-based representation shows a substantial presence compared to other input representation techniques. There are a couple of reasons for this trend. First, graphs provide a natural and intuitive way to represent the structural relationships within the source code. By modeling the code as a graph, the relationships between functions, classes, methods, and variables can be captured effectively. Token-based representation has also gained popularity, with a peak occurrence in 2023. This is because it provides a fine-grained representation of the code. It simplifies the code analysis process by reducing the complexity of the code to a sequence of tokens, making it easier to apply ML models.
图 4 显示了软件漏洞检测研究中数据类型表示的分布情况。如图所示，基于图的表达方式与其他输入表示技术相比，具有显著的存在感。这种趋势有几个原因。首先，图提供了一种自然直观的方式来表示源代码中的结构关系。通过将代码建模为图，可以有效地捕捉函数、类、方法和变量之间的关系。基于标记的表达方式也获得了流行，2023 年达到峰值。这是因为它提供了代码的细粒度表示。它通过将代码的复杂性简化为标记序列，简化了代码分析过程，使得应用机器学习模型变得更加容易。

In this section, we look at embedding methods that can convert these representations explored in the previous section into inputs that ML models can understand. The representation approaches are in a human-readable format and cannot be directly understood by computers. As a result, researchers applied various embedding approaches to translate these representations into numerical format. We discuss the embedding techniques in the following paragraphs.
在这一节中，我们探讨可以将上一节中探索的这些表示转换为机器学习模型可以理解的输入的嵌入方法。表示方法以人类可读的格式存在，不能被计算机直接理解。因此，研究人员应用了各种嵌入方法将这些表示转换为数值格式。我们将在下一段中讨论嵌入技术。

Graph Embedding (32.6%) [97, 117]. This is the most commonly used embedding technique among the subject studies, accounting for 32.6%, which is mostly used by graph neural networks for its capability to capture the structural relationships between different code components.
图嵌入（32.6%）[ 97, 117]。这是主题研究中最常用的嵌入技术，占 32.6%，主要被图神经网络使用，因为它能够捕捉不同代码组件之间的结构关系。

Token Vector Embedding (29.7%) [79, 190]. This is the second most popular technique used by subject studies, accounting for 29.7% of examined papers. In this technique, input is converted into a sequence of tokens and each token is transformed into a numeric value. Then, these values are fed into ML models for training operations.
标记向量嵌入（29.7%）[ 79, 190]。这是学科研究中使用最广泛的第二种技术，占所有审查论文的 29.7%。在这种技术中，输入被转换为一系列标记，每个标记被转换为一个数值。然后，这些数值被输入到机器学习模型中进行训练操作。

Hybrid (16.6%) [19, 41]. We find that 16.6% of the subject studies use multiple embedding techniques to convert inputs to ML models. Different embedding techniques capture different aspects of the data. By combining multiple techniques, researchers can leverage the complementary information provided by each technique. For example, some embedding techniques may focus on syntax, whereas others may capture semantic or contextual information.
混合（16.6%）[19, 41]。我们发现 16.6%的研究对象使用多种嵌入技术将输入转换为机器学习模型。不同的嵌入技术捕捉数据的不同方面。通过结合多种技术，研究人员可以利用每种技术提供的互补信息。例如，一些嵌入技术可能专注于句法，而其他技术可能捕捉语义或上下文信息。

Transformer Embedding (7.2%) [48, 153]. Transformer embedding is used in 7.2% of the subject studies. Despite its lower prevalence, the use of Transformers is notable because of their powerful capabilities in natural language processing, which can be adapted to analyze code.
Transformer 嵌入（7.2%）[ 48, 153]。Transformer 嵌入在 7.2%的主题研究中被使用。尽管其使用频率较低，但 Transformer 的使用值得关注，因为它们在自然语言处理方面的强大能力可以适应分析代码。

Others (13.7%) [126, 146, 163]. The remaining 13.7% that seldom emerge and do not belong to any group are classified as Others.
其他人（13.7%）[126, 146, 163]。其余 13.7%，很少出现且不属于任何群体，被归类为“其他人”。

When it comes to software vulnerability detection, ML models are far superior to conventional manual code analysis techniques. ML-based software vulnerability detection facilitates efficiency and scalability by automating the analysis of massive amounts of code. This ability is essential in the current software development environment, where quick and comprehensive security evaluations are required due to complex systems and frequent changes. This efficiency lowers the possibility of human error that comes with manual inspections while simultaneously speeding up the detection process. Additionally, preemptive threat detection and ongoing monitoring are made easier by ML models. But even with these benefits, human code analysis is still essential for handling some crucial situations. The best people to handle special circumstances like zero-day vulnerabilities [5]—vulnerabilities when exploits are found and used before software developers have a chance to mitigate them—are human analysts.
在软件漏洞检测方面，机器学习模型远优于传统的手动代码分析技术。基于机器学习的软件漏洞检测通过自动化大量代码的分析，提高了效率和可扩展性。这种能力在当前软件开发环境中至关重要，因为复杂的系统和频繁的变更要求快速而全面的网络安全评估。这种效率降低了手动检查中可能出现的人为错误，同时加快了检测过程。此外，机器学习模型还简化了先发制人的威胁检测和持续监控。但即便有这些好处，人类代码分析在处理一些关键情况时仍然是必不可少的。处理像零日漏洞[5]这样的特殊情况的最好人选是人类分析师——即在软件开发者有机会缓解之前，攻击者就已经发现并使用了漏洞的情况。

Transfer learning is crucial for software vulnerability detection. First, high-quality labeled datasets for software vulnerability detection are often scarce and expensive to produce because labeling requires expert knowledge [19, 87, 95]. Second, software vulnerability detection often requires understanding domain-specific languages and contexts, which can vary widely between different applications and systems [33, 95].
迁移学习对于软件漏洞检测至关重要。首先，用于软件漏洞检测的高质量标注数据集通常稀缺且生产成本高昂，因为标注需要专业知识[19, 87, 95]。其次，软件漏洞检测通常需要理解特定领域的语言和上下文，这些在不同应用程序和系统之间可能差异很大[33, 95]。

Among the studies we reviewed, six studies utilized transfer learning for software vulnerability detection. Liu et al. [95] minimized distribution disparities between domains by improving cross-domain representations using a metric transfer learning framework). With this method, the model can still generalize well even in cases when the projects or vulnerability types in the test and training data are different. Du et al. [33] presented a system for detecting software vulnerabilities that makes use of the transfer learning algorithm TrAdaBoost. By using labeled bug reports from one project to predict issue categories in another where labeled data is insufficient, their method identifies bug types across several projects. Sendner et al. [125] customized transfer learning for smart contract software vulnerability detection. Their method, called ESCORT, uses a common feature extractor to understand the semantics of the bytecode, with different branches responding to different kinds of vulnerabilities. The transfer learning capability of ESCORT increases system flexibility by making it easier to include new vulnerability types with less data. Zhou et al. [182] presented a framework for adversarial multi-task learning that integrates common and task-specific components to maximize feature extraction while using adversarial transfer learning to reduce noise and interference between private and general features. Li et al. [77] explored the identification of cross-domain vulnerabilities using VulGDA, a system that combines graph embedding and deep-domain adaptation methods. To capture syntactic and semantic links and improve feature extraction through domain-invariant feature generation, VulGDA transforms samples of source code into graph representations. Zhang et al. [174] proposed CPVD, a cross-domain vulnerability detection method that utilizes labeled data from one source to accurately predict vulnerability labels. CPVD encodes code as property graphs and uses a graph attention network and convolution pooling network for feature extraction.
在所审查的研究中，有六项研究使用了迁移学习进行软件漏洞检测。刘等人[95]通过改进跨域表示来最小化域之间的分布差异（使用度量迁移学习框架）。这种方法使得模型即使在测试和训练数据中的项目或漏洞类型不同的情况下，仍能很好地泛化。杜等人[33]提出了一种利用迁移学习算法 TrAdaBoost 检测软件漏洞的系统。通过使用一个项目的标记错误报告来预测另一个项目中标记数据不足的问题类别，他们的方法能够识别出多个项目中的错误类型。森纳等人[125]为智能合约软件漏洞检测定制了迁移学习。他们的方法称为 ESCORT，使用一个通用的特征提取器来理解字节码的语义，不同的分支响应不同类型的漏洞。ESCORT 的迁移学习能力通过使包含新的漏洞类型更容易，从而提高了系统的灵活性。周等人 [182] 提出了一种对抗多任务学习框架，该框架整合了通用和任务特定组件，以最大化特征提取，同时使用对抗迁移学习来减少私有特征和通用特征之间的噪声和干扰。Li 等人[77]探讨了使用 VulGDA 系统识别跨域漏洞，该系统结合了图嵌入和深度域自适应方法。为了捕获句法和语义链接并通过域不变特征生成来提高特征提取，VulGDA 将源代码样本转换为图表示。Zhang 等人[174]提出了 CPVD，一种跨域漏洞检测方法，它利用一个来源的标记数据来准确预测漏洞标签。CPVD 将代码编码为属性图，并使用图注意力网络和卷积池化网络进行特征提取。

Challenge 1: Heterogeneous Data Sources. The biggest challenge in vulnerability detection through learning is the inadequate modeling of the comprehensive semantics of complex vulnerabilities by current models [26, 27, 126]. Existing ML models often fail to capture the complex patterns of software vulnerabilities because they treat source code like natural language. Unlike natural language, source code contains structural and logical information requiring AST, dataflow, and control flow analysis. To address this, the detection pipeline must use rich representation techniques like control flow and dataflow graphs and proper embeddings to convert these representations into a numerical format for graph-based neural networks.
挑战 1：异构数据源。通过学习进行漏洞检测的最大挑战是当前模型无法充分建模复杂漏洞的综合语义 [26, 27, 126]。现有的机器学习模型往往无法捕捉软件漏洞的复杂模式，因为它们将源代码视为自然语言。与自然语言不同，源代码包含结构和逻辑信息，需要抽象语法树（AST）、数据流和控制流分析。为了解决这个问题，检测管道必须使用丰富的表示技术，如控制流和数据流图以及适当的嵌入，将这些表示转换为基于图神经网络的数值格式。

Challenge 2: Detection Granularity. The effectiveness of DL models in identifying vulnerabilities depends on input granularity. Current models use coarse inputs like methods and files. To achieve finer granularity, program slicing can select crucial statements for detection, but it must be done effectively to reduce noise. Existing tools focus on library/API calls and operations, but these alone are insufficient. A promising approach is using code changes from GitHub, focusing on added and deleted lines, which often have the highest impact on vulnerability detection.
挑战 2：检测粒度。深度学习模型在识别漏洞方面的有效性取决于输入粒度。当前模型使用粗粒度输入，如方法和文件。为了实现更细的粒度，程序切片可以选择关键语句进行检测，但必须有效地进行以减少噪声。现有工具主要关注库/API 调用和操作，但仅此不足以。一种有前景的方法是使用 GitHub 上的代码更改，重点关注新增和删除的行，这些行通常对漏洞检测影响最大。

Challenge 3: Lack of Training Data. A significant weakness of DL models, particularly in software vulnerability detection, is their insatiable need for data [24, 111]. In domains like image classification, abundant labeled data, and pre-trained models enable effective DL training. However, in software vulnerability detection, data scarcity is a major issue due to the difficulty of labeling ground truth information. Platforms like Stack Overflow, GitHub, and issue-tracking systems provide extensive records, but labeling is often manual and challenging. Automatic labeling is a potential solution but tends to generate many false positives. Some researchers use unsupervised classification, but this method also has limited precision.
挑战 3：训练数据不足。深度学习模型的一个显著弱点，尤其是在软件漏洞检测方面，就是它们对数据的无尽需求[24, 111]。在图像分类等领域，丰富的标记数据和预训练模型能够有效地进行深度学习训练。然而，在软件漏洞检测中，由于标记真实信息困难，数据稀缺成为一个主要问题。像 Stack Overflow、GitHub 和问题跟踪系统这样的平台提供了大量的记录，但标记通常是手动且具有挑战性的。自动标记是一个潜在的解决方案，但往往会产生许多误报。一些研究人员使用无监督分类，但这种方法也具有有限的精度。

Multi-Modal Learning. Performing a simple vulnerability detection with source code snippets is not sufficient to have accurate and effective models. Various artifacts are needed to feed into ML models to increase vulnerability detection performance. For example, feeding code comments will increase classification performance remarkably. Some subject studies that use commits [19] argue that feeding source code is not enough and commit characteristics as metadata are required for software vulnerability detection.
多模态学习。仅使用源代码片段进行简单的漏洞检测不足以构建准确有效的模型。需要各种工件来输入机器学习模型，以提高漏洞检测性能。例如，输入代码注释将显著提高分类性能。一些使用提交[19]的专题研究认为，仅输入源代码是不够的，软件漏洞检测还需要提交特征作为元数据。

Just-in-Time Vulnerability Detection. One possible direction for software vulnerability detection is using the just-in-time approaches. This approach focuses on detecting vulnerabilities as they occur or are introduced, hence offering real-time protection [56, 114]. This method allows for faster reaction and mitigation of vulnerabilities before they are exploited.
即时漏洞检测。软件漏洞检测的一个可能方向是采用即时检测方法。这种方法侧重于在漏洞出现或引入时进行检测，因此提供实时保护[56, 114]。这种方法允许在漏洞被利用之前更快地做出反应和缓解。

Leveraging Foundation Models (LLMs) for Vulnerability Detection. Recently, LLMs have been used in a wide variety of software engineering tasks including automatic program repair [59], test case generation, and root cause analysis of incidents in cloud environments. However, the application of LLMs for software vulnerability detection has not been yet discovered comprehensively as it should be. In our survey, we identified some subject studies that utilize LLMs for software vulnerability detection [32, 98, 135, 169]. However, their frequency is still negligible compared to the widespread usage of typical DL models.
利用基础模型（LLMs）进行漏洞检测。最近，LLMs 已被广泛应用于各种软件工程任务中，包括自动程序修复[ 59]、测试用例生成以及云环境中事件的根本原因分析。然而，LLMs 在软件漏洞检测中的应用尚未得到全面发现，正如它应该做到的那样。在我们的调查中，我们确定了某些利用 LLMs 进行软件漏洞检测的研究[ 32, 98, 135, 169]。然而，与典型深度学习模型的广泛应用相比，它们的频率仍然微不足道。