Pith. sign in

REVIEW 4 major objections 5 minor 47 references

A Combined Feature Embedding Tools for Multi-Class Software Defect and Identification

T0 review · 4 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A graph-augmented embedding and a tree-neural hybrid classify five vulnerability classes at 98% accuracy and mark the vulnerable lines.

desk verdict Promising setup, but the headline 98% accuracy is undercut by the paper's own tables, a likely leakage problem, and a GCN architecture that does not line up dimensionally. read the letter →

arxiv 2411.17621 v2 pith:XG6DFG5E submitted 2024-11-26 cs.SE

Md. Fahim Sultan , Tasmin Karim , Md. Shazzad Hossain Shaon , Mohammad Wardat , Mst Shapna Akter This is my paper · ORCID
classification cs.SE
keywords softwarevulnerabilitydetectionmulti-classCWEclassificationfeatureembeddingGraphCodeBERTconvolutionalnetworkDeepTreecode-linelocalizationLIME
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that software vulnerabilities can be classified into specific weakness families and traced to exact source lines much more reliably when the embedding of code is built as a graph rather than as plain text. It proposes CodeGraphNet, which pools GraphCodeBERT token embeddings and passes them through graph-convolutional layers over a line-sequence graph, and pairs it with DeepTree, a hybrid of a decision tree and a neural network. On a balanced public dataset of C/C++ snippets spanning five CWE classes, the combination is reported to reach 98% accuracy and 0.97 AUC, beating the other embeddings and classifiers tested and prior detectors. A separate unseen-dataset check reported by the paper drops to 0.76–0.87 accuracy, so the generalization claim depends on how representative that balanced split is.

What carries the argument

CodeGraphNet is the central object: a feature embedding that builds a directed line-sequence graph $G=(V,E)$ with one node per line of code and edges $(i,i+1)$, forms the adjacency matrix $A$, and applies graph convolution $x'' = A x'$ after a linear transformation $x' = W h_{\text{code}} + b$ of the averaged GraphCodeBERT embedding $h_{\text{code}} = \frac{1}{T}\sum_{t=1}^T h_t$, followed by ReLU and mean pooling. DeepTree is the classifier that carries the result: a decision tree trained on CodeGraphNet features produces class-probability vectors that become the inputs of a neural network, combining interpretable tree splits with learned nonlinear combination. The LIME explainer turns DeepTree's local behavior into per-line vulnerability weights. Together these pieces let the model see both semantic context from the pretrained transformer and line-to-line structure from graph propagation, which is why the paper says it can separate five CWE classes and localize defects.

What would settle it

Take the same five CWE classes, remove any samples that are near-duplicates or come from the same project as training code, split by project rather than randomly, and rerun CodeGraphNet plus DeepTree; if the accuracy lands at the 0.76–0.87 level of the paper's own unseen-dataset table instead of 0.98, the headline claim is an artifact of data overlap.

Watch

Extended reading notes

Core claim

On the paper's own account, CodeGraphNet is the key step. GraphCodeBERT encodes each snippet into 768-dimensional token embeddings, these are averaged per snippet, and a line-sequential directed-graph adjacency matrix propagates line-level features through a graph convolutional network with ReLU; the final per-sample vector is the mean of the transformed node features. That representation is then fed to DeepTree, in which a decision tree first predicts class probabilities and those probabilities become the input features of a neural network trained with Adam and sparse categorical cross-entropy. The paper reports that this pipeline reaches 0.98 accuracy, 0.97 AUC, and 0.96 F1 on the held-out split of its main comparison table, outperforming LSA, GloVe, FastText, CodeBERT, and GraphCodeBERT embeddings across ten classifiers, and that LIME-based highlighting marks vulnerable lines in real-world code examples. It also reports that on an unseen dataset, per-class accuracy ranges from 0.76 to 0.87, which it attributes to overlapping CWE patterns and the limited set of classes.

Load-bearing premise

The 98% result assumes the balanced random train/test split does not leak near-duplicate vulnerable code into both sides, so the test measures true generalization rather than memorization.

Editorial extensions

If this is right

  • Vulnerability detectors could report the exact lines needing repair, not just the vulnerable function, because the same embedding drives both classification and line-level explanation.
  • The DeepTree pattern—decision-tree probabilities as neural-network features—can be lifted to other code-classification problems wherever structured embeddings are available.
  • Code embeddings built from graph propagation over pretrained code models should become the default comparison point for new detectors, since the paper reports that they beat transformer-only and NLP-only embeddings across ten classifiers.
  • Tool builders could prioritize CWE-119, CWE-120, CWE-469, and CWE-476 with high precision if the 0.98 figure holds on project-separated data.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The reported drop from 0.98 on the balanced split to 0.76–0.87 on the unseen dataset is the number to watch: it suggests that near-duplicate code in the random split, not the embedding design, may be carrying much of the measured gain.
  • The line-sequence adjacency matrix used here records only that line $i$ precedes line $i+1$; true data-flow edges, where a value defined on one line is used on another, would test whether graph propagation or merely ordering explains the improvement.
  • Because only five classes are used and the dataset is balanced by random resampling, the practical gain over prior work may be smaller on naturally imbalanced, many-class vulnerability corpora; a project-level evaluation would settle this.
  • The LIME-based highlighter gives local weights, not a causal explanation; using it to drive automated repair would require additional validation that the highlighted lines are sufficient for fixing the vulnerability.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes CodeGraphNet, a feature-embedding method that combines GraphCodeBERT with a graph convolutional network over a line-adjacency graph, and DeepTree, a hybrid decision-tree/neural-network classifier, for five-class CWE vulnerability detection and LIME-based vulnerable-line highlighting. The authors report 98% accuracy for CodeGraphNet plus DeepTree on a balanced VDISC-derived dataset, claim that DeepTree outperforms state-of-the-art approaches, and present qualitative line-level results on Stack Overflow code. The central claims are the 98% accuracy figure and the superiority of DeepTree.

Significance. If the reported 98% accuracy were a valid out-of-sample generalization result and the line-level highlighting were quantitatively validated, the work would be a useful practical contribution to software vulnerability detection. The paper has some positive elements: it uses a publicly documented dataset, provides a public repository link, and describes a reproducible architecture. However, the main quantitative claims are not supported by the reported evaluation: the training/test protocol is not shown to be leak-free, the paper's own Table II contradicts the 'outperforms' claim, and the separate unseen-dataset results in Table III are 11-22 points lower than the headline figure. The significance of the contribution therefore cannot be assessed from the current evidence.

major comments (4)
  1. [Section IV, Table I] The evaluation protocol does not rule out test-set leakage. The text states that a 'random balancing procedure and data augmentation approach' was applied to the dataset before the balanced samples were used for training and independent testing, and Table I reports an 80/20 split of the already balanced set. The paper never states that balancing or augmentation was applied only to training folds, nor does it describe any deduplication, project-level splitting, or clone filtering. If augmented or duplicated samples appear in both partitions, the Table II test results are not a clean out-of-sample estimate, and the 0.98 accuracy is inflated. The drop to 0.76-0.87 accuracy on the unseen dataset in Table III is consistent with this concern and directly undermines the abstract's claim of 98% accuracy as a generalization result.
  2. [Section VI-B, Table II] The claim that DeepTree 'outperforms state-of-the-art approaches' is contradicted by the paper's own results. In Table II, the CodeGraphNet+BERT row reports AUC 0.99, accuracy 0.99, precision 0.99, recall 0.98, F1 0.97, and MCC 0.99, whereas the promoted CodeGraphNet+DeepTree row reports AUC 0.97, accuracy 0.98, precision 0.95, recall 0.96, and F1 0.96. The text justifies the choice of DeepTree on the grounds that BERT is an LLM and 'quite challenging to build', not on superior performance. The abstract and Section VI-E overstate what the data show, and Table IV's cross-paper comparison cannot establish superiority because the compared models were evaluated on different datasets.
  3. [Section V-A, Eqs. (2)-(4)] The proposed graph does not implement the claimed 'where-the-value-comes-from' relationship. The adjacency matrix in Eq. (4) is defined from edges E = {(i, i+1)}, i.e., edges only between consecutive lines of code. The Introduction and the motivating example in Section III claim that the method captures data dependencies, function calls, and contextual relationships, but the actual graph is a simple line-order chain. The GCN in Eq. (6) therefore aggregates only sequential line neighbors, and the reported performance gains cannot be attributed to the semantically richer graph structure that the paper advertises.
  4. [Section VI-C, Fig. 6] The vulnerable-line-highlighting contribution (RQ2) is evaluated only qualitatively. The paper shows examples from Stack Overflow and states that experts reviewed the highlighted lines, but it reports no line-level precision, recall, or F1 and no comparison with existing line-level tools such as LineVul. Without quantitative line-level evaluation, the 'vulnerable lines highlighting' claim is not supported beyond anecdotal demonstration.
minor comments (5)
  1. [Section VI-D] The text refers to 'Table IV' when presenting the unseen-dataset validation results, but the results appear in Table III. This cross-reference error should be corrected.
  2. [Table II] Several rows contain suspiciously identical values across different feature extractors; for example, the Decision Tree row for CodeBERT is identical to the Decision Tree row for GraphCodeBERT (0.58/0.49/0.42/0.39/0.34/0.27/0.24/3.55/1.81), and the DeepTree rows for CodeBERT and GraphCodeBERT are also identical. If this is not a copy-paste error, the paper should explain why different embeddings produce exactly the same metrics.
  3. [Section VII] The discussion states that integrating the classifier with different embedding techniques produces accuracy 'outperforming the results seen in Table II', but Table III reports lower accuracy values than Table II for the CodeGraphNet rows. This sentence appears to reverse the actual comparison and should be rewritten.
  4. [Section VI-A] Reference [43] is cited for the Google Colab Pro+ platform, but [43] is the LIME paper. The platform citation should be a different reference or removed.
  5. [Throughout] There are numerous typos and formatting issues, including 'GrapCodeNet' in Section VI-D, the malformed '0.4 8' entry in the CodeGraphNet SVM row of Table II, and inconsistent use of 'GrapCodeNet' versus 'CodeGraphNet'. A careful proofread is needed.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper's claims are empirical and externally benchmarked; observed weaknesses are validity concerns, not derivation-by-construction.

full rationale

The paper is an empirical machine-learning study, not a derivation. CodeGraphNet embeddings are produced by running the pretrained GraphCodeBERT model over source code, adding a sequential-line adjacency matrix, and passing the result through a GCN (Eqs. 1-8). DeepTree is a stacking classifier trained on the resulting vectors and evaluated on the VDISC split described in Table I. These inputs are external datasets and pretrained models, not the target result. The 0.98 accuracy figure is an out-of-sample test-set number from Table II and is not defined in terms of the conclusion it supports. The comparison in Table IV uses published numbers from other papers, so no load-bearing argument reduces to a self-citation chain. The only self-citation is the Zenodo data repository reference [46], used for data availability, not as evidence for correctness. The paper does contain internal inconsistencies and validity threats, such as BERT achieving 0.99 accuracy in Table II while the abstract claims DeepTree outperforms state-of-the-art approaches, and the possibility of leakage because balancing is described before the train/test split. Those are correctness and reproducibility concerns, not circularity. No fitted parameter is renamed as a prediction, no result is equivalent to its input by construction, and no uniqueness theorem is imported from the authors' prior work. Accordingly, the appropriate circularity score is 0.

Assumptions & free parameters 3 free parameters · 4 assumptions · 2 invented entities

The counts above are the assumptions the reported accuracy actually rests on. The only free parameters explicitly named in the method are the learned weights; all other choices (graph edges, model selection, class balancing) are asserted without external validation. This is a fitted pipeline, not a derivation.

free parameters (3)
  • CodeGraphNet linear transform W and bias b (Eq. 5) = unknown; learned from VDISC training data
    The equation x' = W*hcode + b introduces learned weights that map GraphCodeBERT embeddings into the GCN feature space; these are trained on the same dataset used for the accuracy claim.
  • DeepTree neural network weights = unknown; trained with Adam optimizer
    The hybrid classifier is trained on transformed decision-tree probabilities; its parameters are fit to the same benchmark.
  • Per-class balanced sample sizes after balancing = CWE-119 4502, CWE-120 4496, CWE-469 4500, CWE-476 4503, CWE-other 4508
    The balancing/augmentation procedure sets the class prior to near-uniform, which is a design choice that affects reported accuracy.
assumptions (4)
  • domain assumption GraphCodeBERT embeddings encode C/C++ vulnerability-relevant semantics.
    Section V.A uses the pretrained model's pooled token embeddings as the sole semantic input; if the embedding does not carry security-relevant information, the method fails.
  • ad hoc to paper Sequential line adjacency captures code dependencies.
    Eq. (2) defines edges only as (i, i+1), while the introduction claims 'where-the-value-comes-from' data-flow relations; this premise is asserted, not derived or validated.
  • domain assumption LIME attributions correspond to actual vulnerable lines.
    Section V.E uses LIME weights to mark vulnerable lines; the evaluation only states that experts reviewed highlighted code, with no agreement metric or comparison to ground truth.
  • domain assumption VDISC labels are accurate and the train/test split is leak-free.
    Section IV and Table I assume the dataset labels and random balancing produce a valid benchmark; no deduplication or project-level split is described, and Table III's drop suggests distribution shift.
invented entities (2)
  • CodeGraphNet feature embedding (GraphCodeBERT plus line-adjacency GCN)
    purpose: Produce vulnerability-classification embeddings from source code.
    No code or external replication is provided, and the mechanism is contradicted by its own adjacency definition, which only links consecutive lines.
  • DeepTree (decision-tree probabilities fed to a neural network)
    purpose: Classifier for multi-class CWE prediction.
    Standard stacking; no code, trained weights, or external validation are provided.

how reviews work

0 comments
Cite this review

Pith. "Pith review of A Combined Feature Embedding Tools for Multi-Class Software Defect and Identification." pith.science (2026). https://pith.science/paper/XG6DFG5E

@misc{pith2026241117621,
  author       = {Pith},
  title        = {Pith review of: A Combined Feature Embedding Tools for Multi-Class Software Defect and Identification},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XG6DFG5E}},
  note         = {Machine review of arXiv:2411.17621}
}
read the original abstract

In software, a vulnerability is a defect in a program that attackers might utilize to acquire unauthorized access, alter system functions, and acquire information. These vulnerabilities arise from programming faults, design flaws, incorrect setups, and a lack of security protective measures. To mitigate these vulnerabilities, regular software upgrades, code reviews, safe development techniques, and the use of security tools to find and fix problems have been important. Several ways have been delivered in recent studies to address difficulties related to software vulnerabilities. However, previous approaches have significant limitations, notably in feature embedding and precisely recognizing specific vulnerabilities. To overcome these drawbacks, we present CodeGraphNet, an experimental method that combines GraphCodeBERT and Graph Convolutional Network (GCN) approaches, where, CodeGraphNet reveals data in a high-dimensional vector space, with comparable or related properties grouped closer together. This method captures intricate relationships between features, providing for more exact identification and separation of vulnerabilities. Using this feature embedding approach, we employed four machine learning models, applying both independent testing and 10-fold cross-validation. The DeepTree model, which is a hybrid of a Decision Tree and a Neural Network, outperforms state-of-the-art approaches. In additional validation, we evaluated our model using feature embeddings from LSA, GloVe, FastText, CodeBERT and GraphCodeBERT, and found that the CodeGraphNet method presented improved vulnerability identification with 98% of accuracy. Our model was tested on a real-time dataset to determine its capacity to handle real-world data and to focus on defect localization, which might influence future studies.

Figures

Figures reproduced from arXiv: 2411.17621 by the authors.

Figure 1
Figure 1. Illustration of Vulnerable Code and Highlighting Potential Vulnera [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Workflow of the Architecture Employed in This Study. [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. An illustration of the CodeGraphNet architecture. [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Working strategies of GraphCodeBERT model. [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 5
Figure 5. Figure 5: An Insightful Overview of DeepTree’s Architectural Design [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: Highlighting the vulnerabilities with model outcomes using LIME [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 7
Figure 7. Figure 7: Overall comparison of the model’s performance with the other existing [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

47 extracted references · 41 canonical work pages

  1. [1]

    K2 Cyber Security Inc, Vulnerabilities up almost 10% in 2021,

    work page 2021

  2. [2]

    Buffer overflow vulnerabilities and attacks explained,

    “Buffer overflow vulnerabilities and attacks explained,” [Online]. Available: https://www.comparitech.com/blog/information- security/buffer-overflow-attacks-vulnerabilities/

    work page

  3. [3]

    Internet Crime Report,

    FBI, “Internet Crime Report,” Technical Report, Federal Bureau of Investigation: Washington, DC, USA, 2019

    work page 2019

  4. [4]

    533 million Facebook users’ phone numbers and personal data have been leaked online,

    “533 million Facebook users’ phone numbers and personal data have been leaked online,” 2021. [Online]. Available: https://www.businessinsider.com/stolen-data-of-533-million-facebook- users-leaked-online-2021-4

    work page 2021

  5. [5]

    Multiclass Classification of Software Vulnerabilities with Deep Learning,

    C. Contreras, H. Dokic, Z. Huang, D. S. Raicu, J. Furst, and R. Tchoua, “Multiclass Classification of Software Vulnerabilities with Deep Learning,” in *Proceedings of the 2023 15th International Conference on Machine Learning and Computing (ICMLC ’23)*,[Online]. Available: https://doi.org/10.1145/3587716.3587738

    work page arXiv 2023

  6. [6]

    VMware Flaw a Vector in SolarWinds Breach?,

    “VMware Flaw a Vector in SolarWinds Breach?,” 2020. [On- line]. Available: https://krebsonsecurity.com/2020/12/vmware-flaw-a- vector-in-solarwindsbreach/

    work page 2020

  7. [7]

    Predicting malware attributes from cy- bersecurity texts,

    A. Roy, Y . Park, and S. Pan, “Predicting malware attributes from cy- bersecurity texts,” in *Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, V olume 1 (Long and Short Papers)*, June 2019, pp. 2857–2861

    work page 2019

  8. [8]

    Team Error Point at BLP-2023 Task 2: A Comparative Exploration of Hybrid Deep Learning and Machine Learning Approach for Advanced Sentiment Analysis Techniques,

    R. Das, K. Yeiad, M. Ajmain, J. Maowa, M. Islam, and S. Khushbu, “Team Error Point at BLP-2023 Task 2: A Comparative Exploration of Hybrid Deep Learning and Machine Learning Approach for Advanced Sentiment Analysis Techniques,” in *Proceedings of the First Workshop on Bangla Language Processing (BLP-2023)*, Singapore, 2023, pp. 331–335, Association for Co...

    work page 2023

Show all 47 references
  1. [9]

    Learning a deep hybrid model for semi-supervised text classification,

    A. Ororbia II, C. L. Giles, and D. Reitter, “Learning a deep hybrid model for semi-supervised text classification,” in *Proceedings of the 2015 Conference on Empirical Methods in Natural Language Processing*, Sept. 2015, pp. 471–481

    2015

  2. [10]

    Speaker role contextual modeling for language understanding and dialogue policy learning,

    T. C. Chi, P. C. Chen, S. Y . Su, and Y . N. Chen, “Speaker role contextual modeling for language understanding and dialogue policy learning,” *arXiv preprint* arXiv:1710.00164, 2017

    2017 arXiv

  3. [11]

    Representation Of Lexical Stylistic Features In Language Models’ Embedding Space,

    Q. Lyu, M. Apidianaki, and C. Callison-Burch, “Representation Of Lexical Stylistic Features In Language Models’ Embedding Space,” *arXiv preprint* arXiv:2305.18657, May 29, 2023

    2023 arXiv

  4. [12]

    What’s in a region? or computing control dependence regions in near-linear time for reducible control flow,

    T. Ball, “What’s in a region? or computing control dependence regions in near-linear time for reducible control flow,” ACM Lett. Program. Lang. Syst., vol. 2, no. 1, pp. 1–16, March–Dec. 1993. [Online]. Available: https://doi.org/10.1145/176454.176456

    1993

  5. [13]

    LLM Knows Body Language, Too: Translating Speech V oices into Human Gestures,

    C. Xu, G. Lyu, J. Yan, M. Yang, and C. Deng, “LLM Knows Body Language, Too: Translating Speech V oices into Human Gestures,” in *Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (V olume 1: Long Papers)*, Aug. 2024, pp. 5004–5013

    2024

  6. [14]

    Efficient deep features learning for vulnerability detection using character n-gram embedding,

    M. Alenezi, M. Zagane, and Y . Javed, “Efficient deep features learning for vulnerability detection using character n-gram embedding,” Jorda- nian Journal of Computers and Information Technology (JJCIT), vol. 7, no. 01, 2021

    2021

  7. [15]

    Software Vul- nerability Prediction using Text Analysis Techniques,

    A. Hovsepyan, R. Scandariato, W. Joosen, and J. Walden, “Software Vul- nerability Prediction using Text Analysis Techniques,” 2012. [Online]. Available: https://doi.org/10.1145/2372225.2372230

    2012

  8. [16]

    A multivariate analysis of static code attributes for defect prediction,

    B. Turhan and A. Basar, “A multivariate analysis of static code attributes for defect prediction,” in *Quality Software, 2007. QSIC ’07. Seventh International Conference on*, 2007, pp. 231-237. doi: 10.1109/QSIC.2007.4385500

    2007

  9. [17]

    VulSlicer: Vulnerability detection through code slicing,

    S. Salimi and M. Kharrazi, “VulSlicer: Vulnerability detection through code slicing,” *Journal of Systems and Software*, vol. 193, Nov. 2022. [Online]. Available: https://doi.org/10.1016/j.jss.2022.111450

    2022

  10. [18]

    SlicedLocator: Code vulnerability locator based on sliced dependence graph,

    B. Wu, F. Zou, P. Yi, Y . Wu, and L. Zhang, “SlicedLocator: Code vulnerability locator based on sliced dependence graph,” 2023

    2023

  11. [19]

    Devign: Effective Vulnera- bility Identification by Learning Comprehensive Program Semantics via Graph Neural Networks,

    Y . Zhou, S. Liu, J. Siow, X. Du, and Y . Liu, “Devign: Effective Vulnera- bility Identification by Learning Comprehensive Program Semantics via Graph Neural Networks,” *arXiv preprint* arXiv:1909.03496, Sept. 8, 2019

    1909 arXiv

  12. [20]

    V2W- BERT: A Framework for Effective Hierarchical Multiclass Classification of Software Vulnerabilities,

    S. S. Das, E. Serra, M. Halappanavar, A. Pothen and E. Al-Shaer, “V2W- BERT: A Framework for Effective Hierarchical Multiclass Classification of Software Vulnerabilities,” 2021 IEEE 8th International Conference on Data Science and Advanced Analytics (DSAA), Porto, Portugal, 20...

    2021

  13. [21]

    Instruction2vec: Efficient Preprocessor of Assembly Code to Detect Software Weakness with CNN,

    Y . Lee, H. Kwon, S.-H. Choi, S.-H. Lim, S.H. Baek, and K.-W. Park, “Instruction2vec: Efficient Preprocessor of Assembly Code to Detect Software Weakness with CNN,” Appl. Sci., vol. 9, p. 4086, 2019. [Online]. Available: https://doi.org/10.3390/app9194086

    2019 doi

  14. [22]

    Boosting coverage-based fault localization via graph-based representation learning,

    Y . Lou, Q. Zhu, J. Dong, X. Li, Z. Sun, D. Hao, L. Zhang, and L. Zhang, “Boosting coverage-based fault localization via graph-based representation learning,” in *Proceedings of the 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundat...

    2021

  15. [23]

    Combining deep learning with information retrieval to localize buggy files for bug reports (n),

    A. N. Lam, A. T. Nguyen, H. A. Nguyen, and T. N. Nguyen, “Combining deep learning with information retrieval to localize buggy files for bug reports (n),” in *2015 30th IEEE/ACM International Conference on Automated Software Engineering (ASE)*, IEEE, 2015, pp. 476–481

    2015

  16. [24]

    DeepFL: integrating multiple fault diagnosis dimensions for deep fault localization,

    X. Li, W. Li, Y . Zhang, and L. Zhang, “DeepFL: integrating multiple fault diagnosis dimensions for deep fault localization,” in *Proceedings of the 28th ACM SIGSOFT International Symposium on Software Testing and Analysis*, ACM, 2019

    2019

  17. [25]

    Fault localization with code coverage representation learning,

    Y . Li, S. Wang, and T. Nguyen, “Fault localization with code coverage representation learning,” in *2021 IEEE/ACM 43rd International Con- ference on Software Engineering (ICSE)*, IEEE, 2021

    2021

  18. [26]

    GraphCodeBERT: Pre-training Code Representations with Data Flow,

    D. Guo, S. Ren, S. Lu, Z. Feng, D. Tang, S. Li, L. Zhou, N. Duan, A. Svyatkovskiy, S. Fu, and M. Tufano, “GraphCodeBERT: Pre-training Code Representations with Data Flow,” in *International Conference on Learning Representations*, 2021

    2021

  19. [27]

    CodeBERT: A pre-trained model for programming and natural languages,

    Z. Feng et al. “CodeBERT: A pre-trained model for programming and natural languages,” CoRR, vol. abs/2002.08155, 2020. [Online]. Available: https://arxiv.org/abs/2002.08155

    2002 arXiv

  20. [28]

    LineVul: a transformer-based line- level vulnerability prediction,

    M. Fu and C. Tantithamthavorn, “LineVul: a transformer-based line- level vulnerability prediction,” in *Proceedings of the 19th International Conference on Mining Software Repositories (MSR ’22)*, Association for Computing Machinery, New York, NY , USA, 2022, pp. 608–620. [Onl...

    2022

  21. [29]

    AIBugHunter: A Practi- cal tool for predicting, classifying and repairing software vulnerabili- ties,

    M. Fu, C. Tantithamthavorn, T. Le, et al., “AIBugHunter: A Practi- cal tool for predicting, classifying and repairing software vulnerabili- ties,” Empir Software Eng, vol. 29, no. 4, 2024. [Online]. Available: https://doi.org/10.1007/s10664-023-10346-3

    2024 doi

  22. [30]

    Draper VDISC Dataset- Vulnerability Detection in Source Code

    “Draper VDISC Dataset- Vulnerability Detection in Source Code.” [Online]. Available: https://osf.io/d45bw/. [Accessed: 05-Oct-2024]

    2024

  23. [31]

    and Park, Y

    Kwon, H., Kim, J. and Park, Y . (2017). Applying LSA text min- ing technique in envisioning social impacts of emerging technolo- gies: The case of drone technology. Technovation, 60, pp.15-28. https://doi.org/10.1016/j.technovation.2017.01.001

    2017 doi

  24. [32]

    and Li, C.H

    Yu, B., Xu, Z.B. and Li, C.H. (2008). Latent semantic analysis for text categorization using neural network. Knowledge-Based Systems, 21(8), pp.900-904

    2008

  25. [33]

    and Pan, Y .T

    Chen, W.K., Chen, L.S. and Pan, Y .T. (2021). A text mining-based framework to discover the important factors in text reviews for predicting the views of live streaming. Applied Soft Computing, 111, p.107704

    2021

  26. [34]

    and Mikolov, T

    Joulin, A., Grave, E., Bojanowski, P., Douze, M., J ´egou, H. and Mikolov, T. (2016). Fasttext. zip: Compressing text classification models. arXiv preprint arXiv:1612.03651

    2016 arXiv

  27. [35]

    and Wu, H

    Qiao, C., Huang, B., Niu, G., Li, D., Dong, D., He, W., Yu, D. and Wu, H. (2018). A New Method of Region Embedding for Text Classification. ICLR (Poster)

    2018

  28. [36]

    and Manning, C.D., 2014, October

    Pennington, J., Socher, R. and Manning, C.D., 2014, October. Glove: Global vectors for word representation. In Proceedings of the 2014 con- ference on empirical methods in natural language processing (EMNLP) (pp. 1532-1543)

    2014

  29. [37]

    and Sivakumar, S., 2022

    Anjali Devi, S. and Sivakumar, S., 2022. An efficient contextual glove feature extraction model on large textual databases. International Journal of Speech Technology, pp.1-10

    2022

  30. [38]

    Stochastic gradient descent classifier-based lightweight intrusion detection systems using the efficient feature subsets of datasets,

    J. Azimjonov and T. Kim, “Stochastic gradient descent classifier-based lightweight intrusion detection systems using the efficient feature subsets of datasets,”

  31. [39]

    Multi forests: Variable importance for multi-class outcomes,

    R. Hornung and A. Hapfelmeier, “Multi forests: Variable importance for multi-class outcomes,” *arXiv preprint* arXiv:2409.08925, Sep. 13, 2024

    2024

  32. [40]

    A consolidated decision tree-based intrusion detection system for binary and multiclass imbalanced datasets,

    R. Panigrahi, S. Borah, A. K. Bhoi, M. F. Ijaz, M. Pramanik, Y . Kumar, and R. H. Jhaveri, “A consolidated decision tree-based intrusion detection system for binary and multiclass imbalanced datasets,” *Mathematics*, vol. 9, no. 751, 2021. [Online]. Available: https://doi.org/...

    2021 doi

  33. [41]

    Identifying domain independent update intents in task based dialogs,

    P. Biyani, C. Akkaya, and K. Tsioutsiouliklis, “Identifying domain independent update intents in task based dialogs,” in *Proceedings of the 19th Annual SIGdial Meeting on Discourse and Dialogue*, July 2018, pp. 410–419

    2018

  34. [42]

    MentalManip: A Dataset For Fine-grained Analysis of Mental Manipulation in Conver- sations,

    Y . Wang, I. Yang, S. Hassanpour, and S. V osoughi, “MentalManip: A Dataset For Fine-grained Analysis of Mental Manipulation in Conver- sations,” *arXiv preprint* arXiv:2405.16584, May 26, 2024

    2024 arXiv

  35. [43]

    Why Should I Trust You? Explaining the Predictions of Any Classifier,

    M. T. Ribeiro, S. Singh, and C. Guestrin, “Why Should I Trust You? Explaining the Predictions of Any Classifier,” 2016

    2016

  36. [44]

    Why is this code vulnerable to buffer overflow attacks?,

    Stack Overflow, “Why is this code vulnerable to buffer overflow attacks?,” *Stack Overflow*, [Online]. Available: https://stackoverflow.com/questions/29910520/why-is-this-code- vulnerable-to-buffer-overflow-attacks. [Accessed: Nov. 3, 2024]

    2024

  37. [45]

    Multi-class vulnerability prediction using value flow and graph neural networks,

    C. McLaughlin and Y . Lu, “Multi-class vulnerability prediction using value flow and graph neural networks,” Neural Com- put. Appl., vol. 36, pp. 15869–15891, 2024. [Online]. Available: https://doi.org/10.1007/s00521-024-09819-3

    2024 doi

  38. [46]

    CodeGraphNet,

    “CodeGraphNet,” Online repository. [Online; accessed 25-Oct-2024]. Available: https://zenodo.org/records/14058180

    2024

  39. [2022]

    Available: https://www.k2io.com/the-final-count- vulnerabilities-up-almost-10-in-2021/

    [Online]. Available: https://www.k2io.com/the-final-count- vulnerabilities-up-almost-10-in-2021/

    2021

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.