Using artificial intelligence in the context of buffer overflow vulnerabilities

Result code in IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F62156489%3A43110%2F25%3A43927435" target="_blank" >RIV/62156489:43110/25:43927435 - isvavai.cz</a>

Result on the web

<a href="https://ceur-ws.org/Vol-4013/paper17.pdf" target="_blank" >https://ceur-ws.org/Vol-4013/paper17.pdf</a>

DOI - Digital Object Identifier

—

Result language

angličtina

Original language name

Using artificial intelligence in the context of buffer overflow vulnerabilities

Original language description

The article investigates a method for detecting Buffer Overflow vulnerabilities based on the YOLO neural network. Buffer Overflow vulnerabilities remain a fundamental security concern for modern software systems due to their potential for catastrophic exploitation and persistent presence in both legacy and actively maintained codebases. Traditional detection methods such as static application security testing (SAST) and dynamic analysis offer partial coverage and often struggle with high false positive rates, poor scalability, or limited adaptability to novel vulnerability patterns. This paper presents a novel approach to the automated detection of Buffer Overflow vulnerabilities by leveraging graph-based code representations and the YOLO (You Only Look Once) neural network architecture, originally designed for object detection in computer vision. The study comprehensively reviews current state-of-the-art AI/ML-driven vulnerability detection methods, highlighting their advantages and limitations. The proposed method systematically transforms program code into graph structures and applies YOLO to efficiently localize high-risk code regions. We detail the mathematical risk modeling underpinning the detection process and the workflow for integrating this approach into CI/CD pipelines. A full-scale experiment, using real-world data from CVE and NVD repositories, demonstrates significant improvements in detection accuracy and efficiency compared to leading static analysis tools. The approach achieved 94.3% precision and an F1-score of 93.0% on benchmark datasets, confirming its practical utility for software security assurance. Finally, we discuss challenges, observed limitations, and perspectives for extending the model to additional vulnerability classes and industrial settings.

Czech name

—

Czech description

—

Type

D - Article in proceedings

CEP classification

—

OECD FORD branch

10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)

Project

—

Continuities

I - Institucionalni podpora na dlouhodoby koncepcni rozvoj vyzkumne organizace

Publication year

2025

Confidentiality

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Article name in the collection

CEUR Workshop Proceedings

ISBN

—

ISSN

1613-0073

e-ISSN

1613-0073

Number of pages

10

Pages from-to

211-220

Publisher name

CEUR-WS

Place of publication

Cáchy

Event location

Chmelnyckyj

Event date

Jul 4, 2025

Type of event by nationality

WRD - Celosvětová akce

UT code for WoS article

—