Michael Fu

Michael co-authored DeepVulMatch, a research method that checks for security flaws at both function and individual-line level. Intended to help developers investigate vulnerable code, it combines reusable learned patterns with targeted detection. Its published evaluation on two open-source vulnerability datasets provides evidence of improved detection against 12 comparison methods, supporting further work on automated software-security checks.

Michael Fu is a Lecturer in Software Engineering at the University of Melbourne, researching automated analysis of software security. Finding security flaws and pinpointing the exact lines of code requiring investigation presents a stubborn challenge, particularly when varying coding styles and vulnerabilities spread across multiple lines complicate automated detection.

Michael co-authored DeepVulMatch with Trung Le, Van Nguyen, Chakkrit Tantithamthavorn and Dinh Phung, published in IEEE Transactions on Reliability in 2025. The method learns patterns from vulnerable code and gathers them into a compact ‘codebook’ for checking new code, identifying potentially vulnerable functions and locating suspect lines within them. Evaluated against 12 comparison methods across two datasets of real-world open-source vulnerabilities, DeepVulMatch achieved the highest F1 scores, giving developers a direct way to focus security reviews.