Abstract:During software development and maintenance, vulnerability detection is an essential part of software quality assurance. Even though many program-analysis-based and machine-learning-based approaches have been proposed to automatically detect vulnerabilities, they rely on explicit rules or patterns defined by security experts and suffer from either high false positives or high false negatives. Recently, an increasing number of studies leverage deep learning techniques, especially Graph Neural Network (GNN), to detect vulnerabilities. These approaches leverage program analysis to represent the program semantics as graphs and perform graph analysis to detect vulnerabilities. However, they suffer from two main problems: (i) Existing GNN-based techniques do not effectively learn the structural and semantic features from source code for vulnerability detection. (ii) These approaches tend to ignore fine-grained information in source code. To tackle these problems, in this paper, we propose a novel vulnerability detection approach, named MGVD (M ultiple-G raph-Based V ulnerability D etection), to detect vulnerable functions. To effectively learn the structural and semantic features from source code, MGVD uses three different ways to represent each function into multiple forms, i.e., two statement graphs and a sequence of tokens. Then we encode such representations to a three-channel feature matrix. The feature matrix contains the structural feature and the semantic feature of the function. And we add a weight allocation layer to distribute the weights between structural and semantic features. To overcome the second problem, MGVD constructs each graph representation of the input function using multiple different graphs instead of a single graph. Each graph focuses on one statement in the function and its nodes denote the related statements and their fine-grained code elements. Finally, MGVD leverages CNN to identify whether this function is vulnerable based on such feature matrix. We conduct experiments on 3 vulnerability datasets with a total of 30,341 vulnerable functions and 127,931 non-vulnerable functions. The experimental results show that our method outperforms the state-of-the-art by 9.68% – 10.28% in terms of F1-score.

SVulDetector: Vulnerability Detection Based on Similarity Using Tree-Based Attention and Weighted Graph Embedding Mechanisms

Function-Level Vulnerability Detection Through Fusing Multi-Modal Knowledge

Fine-grained Commit-level Vulnerability Type Prediction by CWE Tree Structure.

VulSniper: Focus Your Attention to Shoot Fine-Grained Vulnerabilities

CSGVD: A deep learning approach combining sequence and graph embedding for source code vulnerability detection

VDSimilar: Vulnerability detection based on code similarity of vulnerabilities and patches

HGVul: A Code Vulnerability Detection Method Based on Heterogeneous Source-Level Intermediate Representation

Distinguishing Look-Alike Innocent and Vulnerable Code by Subtle Semantic Representation Learning and Explanation

Similarity-Based Source Code Vulnerability Detection Leveraging Transformer Architecture: Harnessing Cross- Attention for Hierarchical Analysis

DeepVulSeeker: A novel vulnerability identification framework via code graph structure and pre-training mechanism

MSGVUL: Multi-semantic integration vulnerability detection based on relational graph convolutional neural networks

Vulnerability Detection by Learning from Syntax-Based Execution Paths of Code

Graph Confident Learning for Software Vulnerability Detection

Hybrid semantics-based vulnerability detection incorporating a Temporal Convolutional Network and Self-attention Mechanism

BEDetector: A Two-Channel Encoding Method to Detect Vulnerabilities Based on Binary Similarity

Combining Software Metrics and Text Features for Vulnerable File Prediction

Towards Practical Binary Code Similarity Detection: Vulnerability Verification via Patch Semantic Analysis

Vulnerability Detection for Source Code Using Contextual LSTM

The Vulnerability Is in the Details: Locating Fine-grained Information of Vulnerable Code Identified by Graph-based Detectors

Vulnerability Detection via Multiple-Graph-Based Code Representation

VulMPFF: A Vulnerability Detection Method for Fusing Code Features in Multiple Perspectives