[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-120223-en":3,"doc-seo-120223-105":30,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":27,"seo_description":14,"update_tm":28,"read_time":29},120223,7971461740886,"Theodore","https://ap-avatar.wpscdn.com/davatar_3d24733baf745e90a7e4bdd5f77d97b2",8,"Research & Report","Challenging Machine Learning Algorithms in Predicting Vulnerable JavaScript Functions","Rapidly increasing cyber-crime and the expansion of at-risk devices have brought software security to the forefront. Because many attacks exploit known security weaknesses, locating vulnerable components and applying established mitigations is a practical defense strategy. This paper evaluates state-of-the-art machine learning, including a deep learning method, for predicting functions that may contain security vulnerabilities in JavaScript. Eight algorithms are trained on a new function-level dataset built from public vulnerability sources and GitHub fixing patches, using static code metrics and extensive grid search.","Challenging Machine Learning Algorithms in Predicting Vulnerable JavaScript Functions  \nRudolf Ferenc†, Pter Heged˝us∗ , Pter Gyimesi†, Gbor Antal†, Dnes Bn†, and Tibor Gyimthy∗†  \n∗ MTA-SZTE Research Group on Artificial Intelligence, Szeged, Hungary {[hpeter](hpeter | gyimothy}@inf.u-szeged.hu)[ |](hpeter | gyimothy}@inf.u-szeged.hu)[ gyimothy](hpeter | gyimothy}@inf.u-szeged.hu)[}](hpeter | gyimothy}@inf.u-szeged.hu)[@inf.u-szeged.hu](hpeter | gyimothy}@inf.u-szeged.hu)  \n† Department of Software Engineering, University of Szeged, Szeged, Hungary  \n{[ferenc](ferenc | pgyimesi | antal | zealot}@inf.u-szeged.hu)[ |](ferenc | pgyimesi | antal | zealot}@inf.u-szeged.hu)[ pgyimesi](ferenc | pgyimesi | antal | zealot}@inf.u-szeged.hu)[ |](ferenc | pgyimesi | antal | zealot}@inf.u-szeged.hu)[ antal](ferenc | pgyimesi | antal | zealot}@inf.u-szeged.hu)[ |](ferenc | pgyimesi | antal | zealot}@inf.u-szeged.hu)[ zealot](ferenc | pgyimesi | antal | zealot}@inf.u-szeged.hu)[}](ferenc | pgyimesi | antal | zealot}@inf.u-szeged.hu)[@inf.u-szeged.hu](ferenc | pgyimesi | antal | zealot}@inf.u-szeged.hu)  \narXiv :2405 .07213v1 [ cs .CR] 12 May 2024  \nAbstract—The rapid rise of cyber-crime activities and the growing number of devices threatened by them place software security issues in the spotlight. As around 90% of all attacks exploit known types of security issues, finding vulnerable components and applying existing mitigation techniques is a viable practical approach for fighting against cyber-crime. In this paper, we investigate how the state-of-the-art machine learning techniques, including a popular deep learning algorithm, perform in predicting functions with possible security vulnerabilities in JavaScript programs.  \nWe applied 8 machine learning algorithms to build prediction models using a new dataset constructed for this research from the vulnerability information in public databases of the Node Security Project and the Snyk platform, and code fixing patches from GitHub. We used static source code metrics as predictorsand an extensive grid-search algorithm to find the best performing models. We also examined the effect of various re-sampling strategies to handle the imbalanced nature of the dataset.  \nThe best performing algorithm was KNN, which created a model for the prediction of vulnerable functions with an Fmeasure of 0.76 (0.91 precision and 0.66 recall). Moreover, deep learning, tree and forest based classifiers, and SVM were competitive with F-measures over 0.70. Although the F-measures did not vary significantly with the re-sampling strategies, the distribution of precision and recall did change. No re-sampling seemed to produce models preferring high precision, while resampling strategies balanced the IR measures.  \nIndex Terms—vulnerability, JavaScript, machine learning, deep learning, code metrics, dataset  \nI. INTRODUCTION  \nJavaScript is getting traction not just in client-side web development but as a desktop and server language (Node.js), mobile app language (React Native), or even as an IoT (e.g. JerryScript or the Espruino framework) implementation language. Therefore, programs written in JavaScript are exposed more and more to various security risks.  \nEven though the rapid rise of cyber-crime activities and the growing number of devices threatened by them place software security issues in the spotlight, security concerns of programs are still neglected from time to time. According to past studies [1], around 90% of all attacks exploit known types of security issues. Therefore, finding vulnerable components for applying existing mitigation techniques on them might be a viable practical approach for fighting against cybercrime. In this paper, we investigate how the state-of-theart machine learning techniques – including a popular deep learning algorithm – perform in predicting functions with possible security vulnerabilities in JavaScript programs.  \nSecurity vulnerabilities are very similar to bugs (i.e. most of t","cbCaic0tW8AfBhLi","https://ap.wps.com/l/cbCaic0tW8AfBhLi","pdf",409218,1,7,"English","en",105,"# Introduction\n## JavaScript security risks\n## Limits of bug prediction for vulnerabilities\n## Need for fine-grained (function-level) vulnerability data\n# Dataset and methodology\n## Building a function-level vulnerability dataset\n## Static code metrics and grid search\n## Handling class imbalance with re-sampling\n# Results\n## Best-performing model: KNN\n## Comparison with deep learning, tree/forest, and SVM\n## Impact of re-sampling on precision/recall","[{\"question\":\"Why is function-level vulnerability prediction important for JavaScript?\",\"answer\":\"JavaScript projects are often organized at the file or even single-file level, with fewer higher-level constructs than classes. This makes vulnerable-file predictions less useful, so predictions need to target functions with available vulnerability information.\"},{\"question\":\"How was the dataset for vulnerable JavaScript functions constructed?\",\"answer\":\"The study built a new function-level dataset by extracting vulnerability information from public sources and matching it with GitHub fixing commits and patches. It includes 12,125 functions, of which 1,496 are vulnerable.\"},{\"question\":\"Which algorithm performed best and what were the key metrics?\",\"answer\":\"KNN achieved the best performance for predicting vulnerable functions, with an F-measure of 0.76 (0.91 precision and 0.66 recall). Deep learning, tree/forest-based classifiers, and SVM were also competitive with F-measures above 0.70.\"}]","Challenging Machine Learning Algorithms in Predicting Vulnerable JavaScript Functions | PDF",1785728809,18,{"code":4,"msg":31,"data":32},"ok",{"site_id":24,"language":23,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":28},"challenging-machine-learning-algorithms-in-predicting-vulnerable-javascript-functions","",{"@graph":36,"@context":85},[37,54,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":53},"https://docshare.wps.com/document/challenging-machine-learning-algorithms-in-predicting-vulnerable-javascript-functions/120223/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":23,"description":14,"dateModified":62,"datePublished":62,"encodingFormat":61,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":41,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-08-03",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"Why is function-level vulnerability prediction important for JavaScript?","Question",{"text":75,"@type":76},"JavaScript projects are often organized at the file or even single-file level, with fewer higher-level constructs than classes. This makes vulnerable-file predictions less useful, so predictions need to target functions with available vulnerability information.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How was the dataset for vulnerable JavaScript functions constructed?",{"text":80,"@type":76},"The study built a new function-level dataset by extracting vulnerability information from public sources and matching it with GitHub fixing commits and patches. It includes 12,125 functions, of which 1,496 are vulnerable.",{"name":82,"@type":73,"acceptedAnswer":83},"Which algorithm performed best and what were the key metrics?",{"text":84,"@type":76},"KNN achieved the best performance for predicting vulnerable functions, with an F-measure of 0.76 (0.91 precision and 0.66 recall). Deep learning, tree/forest-based classifiers, and SVM were also competitive with F-measures above 0.70.","https://schema.org",{"og:url":52,"og:type":87,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":89,"canonical":52},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,119,122,127,130,134],{"id":20,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":21,"doc_module":4,"doc_module_name":46,"category_name":116,"show_sort_weight":117,"slug":118},"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":120,"slug":121},30,"research-report",{"id":123,"doc_module":4,"doc_module_name":46,"category_name":124,"show_sort_weight":125,"slug":126},9,"Religion & Spirituality",20,"religion-spirituality",{"id":125,"doc_module":4,"doc_module_name":46,"category_name":128,"show_sort_weight":125,"slug":129},"World Cup","world-cup",{"id":131,"doc_module":4,"doc_module_name":46,"category_name":132,"show_sort_weight":131,"slug":133},10,"Lifestyle","lifestyle",{"id":135,"doc_module":4,"doc_module_name":46,"category_name":136,"show_sort_weight":106,"slug":137},19,"General","general"]