AI-Based Software Vulnerability Detection: A Systematic Literature Review

2025-06-12

AI Summary

Traditional static analysis and rule-based approaches to software vulnerability detection suffer from poor generalizability and high false-negative rates. To address these limitations, this study conducts a systematic literature review (SLR) of AI-driven vulnerability detection research published between 2018 and 2023. We propose the first three-dimensional taxonomy—encompassing AI technique types, code feature representations, and embedding methodologies—and quantitatively analyze 127 primary studies. Our analysis reveals that 91% of the studies employ AI methods, with graph neural networks (GNNs) dominating the landscape. We identify data quality, reproducibility, and model interpretability as three persistent bottlenecks across the field. Furthermore, we highlight emerging directions—including federated learning and quantum neural networks—as promising avenues for future research. The resulting roadmap integrates empirical evidence with forward-looking insights, offering both a theoretical framework and practical guidance for advancing AI-powered security analysis.

Technology Category

• Philosophy and Ethics of AI: Safety, Robustness & Trustworthiness
• Computer Vision: Adversarial Attacks & Robustness
• Humans and AI: Other Foundations of Human Computation & AI

Application Category

• Graph Algorithms and Modeling for the Web: Graph neural networks and deep learning approaches for Web-related graphs
• Search and Retrieval-Augmented AI: Web evaluation methodologies and metrics
• Web Mining and Content Analysis: Robustness and generalizability of Web mining methods

Abstract

Software vulnerabilities in source code pose serious cybersecurity risks, prompting a shift from traditional detection methods (e.g., static analysis, rule-based matching) to AI-driven approaches. This study presents a systematic review of software vulnerability detection (SVD) research from 2018 to 2023, offering a comprehensive taxonomy of techniques, feature representations, and embedding methods. Our analysis reveals that 91% of studies use AI-based methods, with graph-based models being the most prevalent. We identify key limitations, including dataset quality, reproducibility, and interpretability, and highlight emerging opportunities in underexplored techniques such as federated learning and quantum neural networks, providing a roadmap for future research.

Problem

• AI-driven detection of software vulnerabilities in source code
• Systematic review of techniques from 2018 to 2023
• Addressing limitations like dataset quality and interpretability

Innovation

• AI-driven vulnerability detection in source code
• Graph-based models dominate AI techniques
• Exploring federated learning and quantum networks