Question–Answer Methodology for Vulnerable Source Code Review via Prototype-Based Model-Agnostic Meta-Learning

Pablo Corona-Fraga, Aldo Hernandez-Suarez, Gabriel Sanchez-Perez (), Linda Karina Toscano-Medina, Hector Perez-Meana, Jose Portillo-Portillo, Jesus Olivares-Mercado and Luis Javier García Villalba ()
Additional contact information
Pablo Corona-Fraga: Centro de Investigación e Innovación en Tecnologías de la Información y Comunicación, Avenida San Fernando No. 37, Colonia Toriello Guerra, Delegación Tlalpan, Mexico City 14050, Mexico
Aldo Hernandez-Suarez: Instituto Politecnico Nacional, ESIME Culhuacan, Mexico City 04440, Mexico
Gabriel Sanchez-Perez: Instituto Politecnico Nacional, ESIME Culhuacan, Mexico City 04440, Mexico
Linda Karina Toscano-Medina: Instituto Politecnico Nacional, ESIME Culhuacan, Mexico City 04440, Mexico
Hector Perez-Meana: Instituto Politecnico Nacional, ESIME Culhuacan, Mexico City 04440, Mexico
Jose Portillo-Portillo: Instituto Politecnico Nacional, ESIME Culhuacan, Mexico City 04440, Mexico
Jesus Olivares-Mercado: Instituto Politecnico Nacional, ESIME Culhuacan, Mexico City 04440, Mexico
Luis Javier García Villalba: Group of Analysis, Security and Systems (GASS), Department of Software Engineering and Artificial Intelligence (DISIA), Faculty of Computer Science and Engineering, Office 431, Universidad Complutense de Madrid (UCM), Calle Profesor José García Santesmases, 9, Ciudad Universitaria, 28040 Madrid, Spain

Future Internet, 2025, vol. 17, issue 1, 1-39

Abstract: In cybersecurity, identifying and addressing vulnerabilities in source code is essential for maintaining secure IT environments. Traditional static and dynamic analysis techniques, although widely used, often exhibit high false-positive rates, elevated costs, and limited interpretability. Machine Learning (ML)-based approaches aim to overcome these limitations but encounter challenges related to scalability and adaptability due to their reliance on large labeled datasets and their limited alignment with the requirements of secure development teams. These factors hinder their ability to adapt to rapidly evolving software environments. This study proposes an approach that integrates Prototype-Based Model-Agnostic Meta-Learning(Proto-MAML) with a Question-Answer (QA) framework that leverages the Bidirectional Encoder Representations from Transformers (BERT) model. By employing Few-Shot Learning (FSL), Proto-MAML identifies and mitigates vulnerabilities with minimal data requirements, aligning with the principles of the Secure Development Lifecycle (SDLC) and Development, Security, and Operations (DevSecOps). The QA framework allows developers to query vulnerabilities and receive precise, actionable insights, enhancing its applicability in dynamic environments that require frequent updates and real-time analysis. The model outputs are interpretable, promoting greater transparency in code review processes and enabling efficient resolution of emerging vulnerabilities. Proto-MAML demonstrates strong performance across multiple programming languages, achieving an average precision of 98.49 % , recall of 98.54 % , F1-score of 98.78 % , and exact match rate of 98.78 % in PHP, Java, C, and C++.

Keywords: question–answer methodology; vulnerable source code review; prototype-based learning; model-agnostic meta-learning; Proto-MAML; code vulnerability detection; software security; few-shot learning; source code analysis; meta-learning techniques; automated code review; cybersecurity; knowledge transfer; code reconstruction (search for similar items in EconPapers)
JEL-codes: O3 (search for similar items in EconPapers)
Date: 2025
References: View references in EconPapers View complete reference list from CitEc
Citations:

Downloads: (external link)
https://www.mdpi.com/1999-5903/17/1/33/pdf (application/pdf)
https://www.mdpi.com/1999-5903/17/1/33/ (text/html)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:gam:jftint:v:17:y:2025:i:1:p:33-:d:1566725

Access Statistics for this article

Future Internet is currently edited by Ms. Grace You

More articles in Future Internet from MDPI
Bibliographic data for series maintained by MDPI Indexing Manager ().