A deep learning framework for vulnerability detection in open-source repositories using code embeddings

Software vulnerability detection remains one of the critical challenges within the domain of software security, as flawed code can result in severe breaches and exploitation. Although recent progress with transformers and large language models, namely CodeBERT, and CodeLlama, have enhanced automated code understanding, these models require extensive computational resources for training and often face challenges in terms of generalization across diverse vulnerability types and multiple programming languages. Accordingly, in this work, the authors propose a deep learning based framework that can be effectively integrate code embeddings including Word2Vec, TF-IDF representations, and handcrafted contextual features to detect vulnerabilities over multiple Common Weakness Enumeration (CWE) classes. This multi-CWE classification framework maintains an appropriate balance between representation learning and efficiency using a fully connected neural network architecture trained on a balanced multi-language dataset. The experimental evaluations prove that the proposed model can achieve an accuracy of 90.41%, precision of 0.89, recall of 0.90, and F1-score of 0.89, outperforming several state-of-the-art baselines, including CodeBERT-based frameworks including LLMxCPG and SW Security. Furthermore, in comparison to PRIMEVUL baseline which obtains F1-scores below 5% on realistic benchmarks, the proposed model gets ahead by showing strong and consistent detection capability. The performance metrics show that integrating feature engineering in the script can assist in obtaining scalability and accuracy both for practical software security applications.