EXPLAINABLE ARTIFICIAL INTELLIGENCE FOR EARLY DETECTION AND PREDICTION OF SOFTWARE VULNERABILITIES

Abstract

Software vulnerabilities can arise at different stages of development, and some may be discovered only during deployment or exploitation. Although rule-based static analysis identifies known insecure patterns, it has limitations in representing complex structures like control flows and data dependencies. Additionally, software relies on external libraries, and a fixed set of rules cannot capture all insecure patterns. With labelled data, ML and DL models can discover insecure patterns; however, they lack transparency in explaining why they predict a given piece of code is insecure. In this study, we propose an end-to-end XAI-based framework for early vulnerability detection and proposal that integrates data processing, representation, and classification; explanation generation; localization; and developer review. For evaluation, we compare the framework with Logistic Regression, Random Forest, XGBoost, and CodeBERT, as well as a CodeBERT variant further enhanced with explanation. We present a simplified demonstration using 1,000 synthetic code function records and report example figures generated using our simulation. In the example demonstration, the model-comparison table awarded the highest illustrative scores to XAI-CodeBERT among the SHAP-generated explanations. The authors argue that for a vulnerability detector to be useful in practice, it should balance several factors, including accuracy, recall, and precision, as well as class-specific performance, explanation faithfulness, and localization quality. The main contribution is a research framework that considers vulnerability prediction and explanation as related aspects of secure software development.