Jacobs personal page

Jacob Merrill – Personal Research Page

Papers Read

1. Malicious Code Detection in Smart Contracts via Opcode Vectorization

This paper presents a machine learning model that detects malicious smart contracts using opcode bigram vectorization and TF-IDF weighting. The authors evaluate several classifiers and find comparable performance across models. However, the study is limited by dataset imbalance and small sample size.

The key takeaway is that opcode-level structural representation enables automated vulnerability detection, but model performance depends heavily on dataset quality.

---

2. AST-Based Vulnerability Classification

This paper proposes using Abstract Syntax Tree (AST) n-grams combined with a Random Forest classifier to detect and classify software vulnerabilities by CWE type. The approach outperforms traditional code metrics and improves vulnerability-specific remediation.

The key contribution is moving beyond binary vulnerability detection to multi-class vulnerability classification.

---

Personal Synthesis

Both papers highlight the importance of structural code representation in machine learning-based vulnerability detection. Opcode and AST representations capture deeper patterns than surface-level metrics.

However, both approaches depend on labeled datasets. If datasets contain incorrect or inconsistent labels, model performance will degrade significantly. Research suggests vulnerability datasets may contain substantial labeling errors, which presents a major challenge.

Improving dataset quality may therefore provide greater gains than developing more complex models.

---

Project Contribution

I am contributing to the project by:

• Analyzing structural code representation methods (AST and opcode)
• Identifying dataset imbalance and labeling challenges
• Proposing an AI-assisted dataset validation approach
• Drafting the minimum viable product (MVP) vision

---

MVP Vision (Epic)

AI-Assisted Vulnerability Dataset Validation Tool

The minimum viable product will:

1. Import a labeled vulnerability dataset
2. Extract structural features (AST or opcode-based)
3. Train a baseline classifier
4. Use anomaly detection to flag suspicious or inconsistent labels
5. Output flagged samples for manual review

The goal is to improve dataset reliability and increase vulnerability detection accuracy.