An Empirical Analysis of Transformer-Based Models with LIME Explainability for JavaScript Vulnerability Detection

In this paper, we propose an explainable and intelligent deep learning framework that detects software vulnerabilities in JavaScript source code using transformer-based architectures. JavaScript is one of the most widely used programming languages for web development and is often susceptible to numerous security vulnerabilities that can compromise the integrity of data and applications. Manually identifying code vulnerabilities is difficult, necessitating the use of automated and intelligent methods for accurate code classification. To this end, we employed four state-of-the-art transformer-based architectures, CodeBERT, CodeT5+, PLBART, and UniXcoder, which were fine-tuned on a large and diverse function-level JavaScript dataset of vulnerabilities. Each model was trained to classify functions as vulnerable or non-vulnerable based on the code semantics and potential vulnerabilities in the function’s code. Among these transformer-based models, UniXcoder performed the best, with an accuracy of 89.69%, precision of 92.51%, recall of 86.26%, and F1-score of 89.26%. Furthermore, a LIME-based explainability analysis uncovered important aspects of the model’s decision-making process, establishing that valid predictions were based on relevant and meaningful features of the code. Our results show that transformer-based models can be a reliable and scalable way to improve software security by providing an efficient and interpretable basis for automated JavaScript vulnerability detection.