Increasing numbers of software vulnerabilities are discovered every year whether they are
reported publicly or discovered internally in proprietary code. These vulnerabilities can pose
serious risk of exploit and result in system compromise, information leaks, or denial of
service. We leveraged the wealth of C and C++ open-source code available to develop a
largescale function-level vulnerability detection system using machine learning. To
supplement existing labeled vulnerability datasets, we compiled a vast dataset of millions of …

Each year, software vulnerabilities are discovered, which pose significant risks of
exploitation and system compromise. We present a convolutional neural network model that
can successfully identify bugs in C code. We trained our model using two complementary
datasets: a machine-labeled dataset created by Draper Labs using three static analyzers
and the NIST SATE Juliet human-labeled dataset designed for testing static analyzers. In
contrast with the work of Russell et al. on these datasets, we focus on C programs, enabling …