LEO: An Information-theoretic Learning-based Approach for Identifying Out-of-distribution Source Code in Software Systems

Effective software development and management are crucial for creating and maintaining reliable software systems, whether web-based or standalone, ensuring enhanced functionality and performance. Throughout these processes, regular integration and management of source code facilitate seamless deployment, maintenance, and updates. To ensure robust source code security, AI-based software vulnerability detection (SVD) methods are often used, trained on labeled CWE source code data sets (in-distribution (ID) data). While SVD methods effectively detect vulnerabilities in data from distributions similar to the ID training set, they often struggle with out-of-distribution (OOD) CWE data, limiting their ability to protect software systems against potential OOD attacks. To mitigate this issue, addressing the OOD source code identification problem, determining whether input data is in-distribution or OOD CWE categories, offers a crucial solution. This approach enables software developers and security analysts to take proactive precautions and security measures, adding an important layer of defense. While OOD data identification has been widely designed for computer vision, text, and medical diagnosis applications, automated AI-based techniques for OOD source code identification in software systems have not yet been well-studied. To this end, we propose LEO , an innovative deep learning-based approach that effectively leverages source code characteristics to enhance data representation learning for OOD source code identification. The rigorous and comprehensive experiments on real-world CWE source code data sets show the effectiveness and advancement of our approach compared to seven related state-of-the-art baselines by a wide margin . In short, on average, our method achieves a significantly higher performance around 19.82%, 6.75%, and 4.12% on the FPR, AUROC, and AUPR measures, respectively, over the second-highest baseline.