  Increasing numbers of software vulnerabilities are discovered every year
whether they are reported publicly or discovered internally in proprietary
code. These vulnerabilities can pose serious risk of exploit and result in
system compromise, information leaks, or denial of service. We leveraged the
wealth of C and C++ open-source code available to develop a large-scale
function-level vulnerability detection system using machine learning. To
supplement existing labeled vulnerability datasets, we compiled a vast dataset
of millions of open-source functions and labeled it with carefully-selected
findings from three different static analyzers that indicate potential
exploits. The labeled dataset is available at: https://osf.io/d45bw/. Using
these datasets, we developed a fast and scalable vulnerability detection tool
based on deep feature representation learning that directly interprets lexed
source code. We evaluated our tool on code from both real software packages and
the NIST SATE IV benchmark dataset. Our results demonstrate that deep feature
representation learning on source code is a promising approach for automated
software vulnerability detection.
