AMBER: A Semantic Aware Detection of Code Vulnerabilities and Their Clones
The identification of vulnerabilities in software and their clones is crucial for secure software development, but achieving high accuracy whilst maintaining a scalable detection system is difficult. We introduce Amber, a semantic-aware framework that utilizes semantic embeddings, structural program features, and similarity metrics to construct a multi-channel representation, which is fed to a convolutional neural network (CNN) for vulnerability detection, and then further employed in a FAISS-based semantic similarity search for finding vulnerable code segments that can be reused in other large codebases. In addition to real-world data from open-source repository data sets, Amber is assessed on 12,303 vulnerable functions and 21,057 non-vulnerable functions from the SARD vulnerability database. Regarding accuracy, recall, and F1-score, Amber demonstrated superior performance over several leading baselines, including VulCNN, VulDeePecker, SySeVR, and Devign. In addition, Amber enables post-classification vulnerable clone detection, providing a deep understanding of vulnerabilities through hidden and subtle vulnerable clones. This work provides a scalable and explainable framework for development and security practitioners, helping to advance the automation of vulnerability and their clone detection and improve software security practices overall.