Token-aware windows
Long functions are cleaned and split consistently so relevant code is not silently truncated.
PREPROCESS / WINDOWML SECURITYC / C++FUNCTION LEVEL
MODEL / CALIBRATED STACKTEST WINDOW / 2022—2024MODE / ANALYST ASSIST
Find the code
worth reviewing.
VULNERA ranks risky C and C++ functions using learned code representations, calibrated ensemble scoring, corroborated signatures, and explainable evidence.
TEST RECALL72.7%
TEST F10.477
HELD-OUT FUNCTIONS14,170
Forward temporal evaluation.
Human review remains required.
NOTICE
THIS IS A TRIAGE INSTRUMENT — NOT AN AUTONOMOUS VULNERABILITY ORACLE.
RISK SCORES PRIORITIZE REVIEW. EVIDENCE SUPPORTS JUDGMENT.
01 / ANALYST INSTRUMENTSignal, context,
Signal, context,
and the code.
Select a function to inspect the evidence behind its queue position.
REVIEW QUEUE4 functions above 0.50
FUNCTIONRISKEVIDENCE
FUNCTION / parse_packet
0.84REVIEW
CALIBRATED RISK0.84 / HIGH
CORROBORATIONCWE-787
TOP CONTRIBUTORWINDOW 03 / 0.91
DISPOSITIONANALYST REVIEW
src/net/parser.c : 184—231C
184 int parse_packet(char *input) { 185 struct packet packet; 186 parse_header(input, &header); 187 memcpy(packet.data, input, header.length); 188 return process(&packet); 189 }
MODEL NOTE
High-risk window aligns with an unsafe memory operation and untrusted length flow. Confirm bounds handling across callers.
02 / EVIDENCE LAYERSNo single signal
No single signal
gets the final word.
Multiple bounded evidence layers build a reviewable case, without overstating certainty.
Learned representation
GraphCodeBERT embeddings capture structural and semantic patterns across each function window.
GRAPHCODEBERT / CLSRFXGLGET→P
Calibrated ensemble
Tree models and a meta learner combine, then isotonic calibration aligns score with observed risk.
STACK / CALIBRATECWE-787+0.08Bounded corroboration
CWE signatures support the learned score with capped uplift and visible pattern evidence.
SIGNATURE / CAP03 / RESEARCH METHODMeasured forward.
Measured forward.
Not memorized backward.
TRAINHistorical functionsPrimeVul · DiverseVul · Big-Vul · CVEfixes
VALIDATEThreshold + calibrationModel selection without touching test era
TEST / 2022—2024Forward-era vulnerabilities14,170 held-out functions
Temporal separation
Older data trains the system; later vulnerability data measures generalization in a more realistic direction.
Recall-first threshold
The deployed operating point favors finding risky functions for review, while retaining visible precision tradeoffs.
Human-in-the-loop output
Scores, windows, code markers, signatures, and optional explanations support analyst judgment rather than replace it.
04 / SYSTEMResearch pipeline.
Research pipeline.
Usable surface.
UPLOAD
C / C++→EMBED
PYTORCH→SCORE
ENSEMBLE→EXPLAIN
SHAP + CWE→REVIEW
REACT UI
C / C++→EMBED
PYTORCH→SCORE
ENSEMBLE→EXPLAIN
SHAP + CWE→REVIEW
REACT UI
PythonGraphCodeBERTXGBoostLightGBMscikit-learnSHAPFastAPIReact
OPEN RESEARCH / OPEN SOURCEInspect the pipeline.