Real-Time Code Vulnerability Detection Using a Machine Learning-Integrated Language Server

Aug 5, 2026

Rapid software development boosts productivity while increasing security risk when developers skip essential scans due to time pressure or limited tooling. This study proposes a real-time vulnerability detection system that integrates machine learning into a Language Server Protocol framework for inline security support. It performs line-level analysis using a Random Forest classifier over tokenized code processed via AST traversal and TF-IDF vectorization, classifying four CWE types. Trained on 20,000 labeled code lines, the model attains 82.3% accuracy and 80.7% F1-score, with average diagnostics of 72 ms for interactive workflows.

LanguageEnglish

CategoryTechnology

FormatPDF

Pages15

Reading Time38 min

AccessFree to download

Abstract

1. Introduction

Security risks in software development

Vulnerabilities during the coding phase

Motivation for ML-based and real-time detection

2. Proceedings of Engineering and Technology Innovation

Limits of traditional static analysis tools

Opportunities from machine learning

Line-level detection and granularity

Real-time detection integration with an LSP

Proceedings of Engineering and Technology Innovation, vol. x, no. x, 20xx, pp. xx-xx Real-Time Code Vulnerability Detection Using a Machine Learning Integrated Language Server Ariel Roy Luceño Reyes*, Mark David Dayanan Prado, Raffy Beting Suarez, Rovenado Nesta Abellana Villotes College of Information and Computing, University of Southeastern Philippines, Davao, Philippines Received 22 April 2025; received in revised form 12 November 2025; accepted 17 November 2025 DOI: [https://doi.org/10.46604/peti.2025.15065](https://doi.org/10.46604/peti.2025.15065) Abstract The rapid growth of software development has improved productivity but also introduced security risks, especially when developers skip essential scans due to time constraints or limited tool support. This study proposesa real-time vulnerability detection system that integrates machine learning (ML) into a language server framework to enhance software security during coding. The system uses a Language Server Protocol (LSP) architecture with a Random Forest classifier that analyzes source code at the line level. Code is pre-processed through tokenization, abstract syntax tree (AST) traversal, and TF-IDF vectorization before being classified into four vulnerability types: CWE-79 (Cross-Site Scripting), CWE-89 (SQL Injection), CWE-22 (Path Traversal), and CWE-434 (Unrestricted File Upload) . Using 20,000 labeled code lines, the model achieves 82.3% accuracy and an F1-score of 80.7%, performing best on CWE-79 and CWE-89 and showing weakest performance on CWE-434 . The language server averages 72 ms per diagnostic, demonstrating its suitability for real-time developer workflows. Keywords: code vulnerability detection, CWE, Language Server Protocol, machine learning 1. Introduction The rapid growth of software development has revolutionized operations for both enterprises and individuals, enabling them to handle daily tasks more efficiently, accelerate processes, and enhance overall productivity. However, this shift toward digital solutions has also introduced significant security risks. According to Cabrera et al. [1], security is one of the biggest concerns in the digital world. Many software applications are developed with vulnerabilities that attackers can exploit, often resulting in data breaches, financial losses, and reputational damage [2-3] . Studies reveal that most vulnerabilities emerge during the coding phase of the software development lifecycle, often made worse by developers frequently bypassing crucial security scans due to time constraints and a lack of proper tooling [4] . Software vulnerabilities, defined as weaknesses or flaws that can be exploited to compromise a system’s confidentiality, integrity, or availability, continue to pose a significant challenge in cybersecurity [5] . Common security vulnerabilities include buffer overflows and injection-based attacks, which can impact popular software applications [6-7] . For example, an SQL Injection vulnerability in Palo Alto Networks Expedition, identified as CVE-2024-9465, allowed unauthorized access to sensitive data and system functions [8] . Similarly, CVE-2024-51378 showcased the exploitation of poorly secured endpoints, allowing attackers to bypass authentication mechanisms and execute arbitrary commands [9] . * Corresponding author. E-mail address: [ariel.reyes@usep.edu.ph](ariel.reyes@usep.edu.ph) 2 Proceedings of Engineering and Technology Innovation, vol. x, no. x, 20xx, pp. xx-xx Despite the urgency of addressing these issues, traditional vulnerability detection tools often fail to integrate seamlessly into modern development workflows. Although effective at identifying vulnerabilities before the production phase of software products, static analysis tools are typically separate from live coding environments, resulting in prolonged remediation times and inefficiencies [10] . This reflects a broader challenge where process improvements for integrating security t

FAQs

What problem does the proposed system address?

It addresses the security risk created when developers bypass essential vulnerability scans and when existing static analysis tools do not integrate well into live coding workflows.

How does the system detect vulnerabilities in real time?

It integrates a Random Forest ML classifier into an LSP-based language server, analyzing source code at the line level after tokenization, AST traversal, and TF-IDF vectorization.

Which vulnerability types does the model classify and how well does it perform?

It classifies four CWE types: CWE-79, CWE-89, CWE-22, and CWE-434. Using 20,000 labeled code lines, it achieves 82.3% accuracy and an F1-score of 80.7%, with diagnostics averaging 72 ms.

Aug 5, 2026

Upload by Valentina