AUTOMATED CODE VULNERABILITY DETECTION USING STATIC ANALYSIS AND TRANSFORMER-BASED SOURCE CODE EMBEDDINGS

Abstract

This paper provides a comprehensive review of automated code vulnerability detection methodologies integrating static analysis techniques with transformer-based source code embeddings, examining how hybrid systems are redefining software security assurance in an era of escalating software complexity and rapid open-source proliferation. The vulnerability lifecycle comprising black risk (discovery to disclosure), gray risk (disclosure to patching), and white risk (post-countermeasure) phases establishes the temporal urgency for automated detection, with transformer-based analysis achieving approximately twice the accuracy of statistical keyword approaches in identifying emerging threats before official notification. The transformer architecture's self-attention mechanism enables parallel processing and weighting of distant tokens, proving uniquely suited for code where variable definitions and subsequent misuse may span hundreds of lines. Specialized models examined include CodeBERT for bimodal natural language and programming language understanding, GraphCodeBERT integrating data flow graphs through graph-guided masked attention, and UniXcoder incorporating abstract syntax trees. Hybrid methodologies demonstrate substantial improvements: the SIExVulTS framework combining transformer-based source-sink identification, CodeQL propagation analysis, and GraphCodeBERT semantic verification increased precision from 22.61% to 87.23%, leading to discovery of six new CVEs in Apache projects. Granularity advances from function-level to statement-level localization through node classification over program dependency graphs and attention-based methods achieve Top-10 Accuracy of 0.65, significantly outperforming graph-based baselines. Explainable AI frameworks provide faithful justifications measured by mean statement precision and recall, while large language models generate natural language descriptions of root causes and mitigations. Empirical comparisons show transformer models achieving F1 scores of 0.75-0.79 on real-world projects, substantially outperforming industrial static analyzers scoring 0.26-0.55.