VulnLens

Inspiration Memory-safety bugs like buffer overflows, use-after-free and integer overflows are still the biggest class of exploited vulnerabilities in C/C++. They slip through pull-request review in big code bases like FFmpeg and QEMU because reviewers are short on time. I wanted a fast first pass that tells a reviewer which functions to look at and which line is the problem.

What it does VulnLens scores every function in a C/C++ file for vulnerability risk, explains the score (for example strcpy pushes it up, deep nesting adds risk), and runs 8 CWE line rules (CWE-120, 125, 134, 190, 416, 770, 787) that point at the exact line with fix advice. It works three ways: a static web app, a Gradio app, and a CLI/CI gate that fails a build when a function scores above a threshold.

How I built it • Dataset: CodeXGLUE Defect Detection (Devign), 27,318 real C functions from FFmpeg and QEMU, official train/validation/test splits. • Model: TF-IDF over normalised code tokens plus 19 hand-crafted risk features, fed to logistic regression in scikit-learn. Linear, so every score is explainable. • Hyper-parameters and thresholds picked on validation only; the test set was scored once. • The browser demo re-implements the same model in JavaScript from an exported 1 MB model.json, and a test checks it matches the Python scorer to 1e-6 on 200 real functions.

Results (Devign test set, 2,732 functions) • Precision mode: 63.65% accuracy (95% CI 61.9 to 65.5), ROC-AUC 0.704. Published CodeBERT baseline is 62.08%, so it is on par at a fraction of the cost; the intervals overlap, so I don't claim it is significantly better. • Review mode: flags 92.7% of truly vulnerable functions (F1 66.6%) for PR triage. • Speed: 0.95 ms median per function on a 2-core CPU, no GPU. • Leakage check: removing 17 duplicate functions leaves accuracy at 63.9%.

Challenges I ran into Devign is a hard, noisy benchmark where even large models stay near 60 to 70%. Keeping the test set untouched until the end, and making the JavaScript version give exactly the same scores as Python, took the most care.

Accomplishments I'm proud of Matching a GPU fine-tuned 125M-parameter model with a 1 MB model that runs in the browser in milliseconds, with every score explainable and no code leaving the user's machine.

What I learned How much evaluation discipline matters: separate validation and test, confidence intervals, and leakage checks change how honestly you can report a result.

What's next Data-flow-aware models (code graphs or code LLMs) to cut false positives like a correctly bounded memcpy, plus a GitHub Action for pull requests.

AI tools disclosure Built with substantial help from an AI coding assistant ( LLM-based agent), which wrote large parts of the code, ran experiments and drafted the README under my direction. I chose the problem and approach, reviewed the code and results, and am responsible for the submission.

Built With

• gradio
• html
• javascript
• node.js
• numpy
• pandas
• pyarrow
• pytest
• python
• scikit-learn
• scipy