Deep Learning and evidential reasoning for software vulnerability analysis

This study investigates the use of deep learning, statistical tests and artificial intelligence reasoning techniques to identify software weaknesses such as CWEs from source code. Secondly, the proposed methods detect risk signals in the metadata associated with software commits to repositories such as GitHub, and we further explore the combination of the source code with its metadata to identify risky commits. Thirdly, we investigate the use of AI reasoning techniques to chain, or correlate, these risk signals horizontally across multiple software commits to recognise software weakness chains.<br><br>This thesis demonstrates a strong potential to apply deep learning, statistical tests, and artificial intelligence reasoning techniques in software weakness detection while improving prediction accuracy.

We provide a foundation for future studies on reasoning software weaknesses. This also helps developers understand the corresponding attack strategies behind risk signals by building up a more comprehensive view of the attack scenarios, allowing them to make timely decisions and take appropriate actions.