Static Code Analysis Framework for Automated Security Vulnerability Detection

Abstract

The proliferation of software security vulnerabilities in modern applications has created an urgent demand for automated, intelligent, and scalable detection systems. Existing rule-based static analysis tools are effective for predefined vulnerability patterns but may have difficulty with variations that are not adequately covered by their rules, and a substantial portion of existing machine-learning-based vulnerability detection research focuses on C and C++ programs, while Python-specific approaches remain comparatively less explored. This paper presents a static code analysis framework for automated security vulnerability detection specifically targeting Python source code. The proposed framework implements a three-phase experimental pipeline: Phase 1 establishes a token-based TF-IDF baseline by representing source code as typed token pairs and training classical machine learning classifiers; Phase 2 introduces up to 35 hand-engineered structural features extracted from the Abstract Syntax Tree (AST) of each code snippet using the NodeVisitor design pattern; and Phase 3 combines both feature types into a unified representation and retrains all classifiers — Random Forest, Gradient Boosting, Logistic Regression, and Support Vector Machine. The system is trained and evaluated on a manually constructed, balanced dataset of 70 Python code snippets covering five high-severity CWE vulnerability categories: SQL Injection (CWE-89), OS Command Injection (CWE-78), Path Traversal (CWE-22), Insecure Deserialization (CWE-502), and Cross-Site Scripting (CWE-79). Recall is designated as the primary optimization metric because missed vulnerabilities carry greater risk than false alarms in security-critical deployment contexts. Experimental results show that AST-based structural features substantially improve recall compared with the TF-IDF baseline, while the combined TF-IDF and AST representation maintains this improved performance. The complete system is deployed as a command-line prediction tool producing a binary verdict, a continuous risk score, and a structured report of detected dangerous API patterns, and runs entirely on standard consumer hardware without GPU or deep-learning infrastructure requirements.