CAREER: Rethinking AI-based Vulnerability Detection for Open-Source Software

Open-source software is now a foundation of modern computing systems used across industry, government, academia, and critical infrastructure. Its openness fosters innovation and productivity, but it also creates security risks because anyone can contribute code, including inexperienced developers who unintentionally introduce weaknesses and malicious actors who hide vulnerabilities or backdoors. These weaknesses can spread quickly to many downstream systems, affecting financial services, public safety, and national security, inter alia. This project develops artificial intelligence methods that help open-source communities detect risky code changes earlier in the software development process. The project’s novelties are its focus on vulnerabilities as evolving code-change behaviors rather than isolated pieces of code, its construction of high-quality commit-level vulnerability data, and its development of interpretable and resource-efficient artificial intelligence models for software security. The project's broader significance and importance are its potential to make vulnerability detection more practical for open-source communities with limited human and computational resources, while also supporting education and workforce development in secure software engineering. This project develops a new framework for artificial intelligence-based vulnerability detection from open-source software commits. The first research thrust refines input data by decomposing tangled commits, integrating related code changes across commits, and constructing a fine-grained dataset of vulnerability-introducing code changes. The second thrust develops multimodal representations that capture both code-change semantics and commit behaviors, including dependency evolution, caller-callee relationships, and repository-level development patterns. The third thrust creates an interpretable detection system using reinforcement learning, where vulnerability-specific reward signals guide models to reason about code locations, dependency relationships, root causes, and security impacts. These research thrusts are complemented by an evaluation plan, including studies on real-world open-source repositories. The project outcomes include improved early detection of software vulnerabilities, reusable research infrastructure for the software security community, and publicly available learning materials that prepare students and professionals to build and maintain more secure software systems. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.