ReGVD: Revisiting Graph Neural Networks for Vulnerability Detection

2021/10/14 by Van-Anh Nguyen, Nguyen, Van-Anh, Dai Quoc Nguyen +9 · 15 citations
Computer Science · #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Information and Cyber Security #Machine Learning (cs.LG) #Software Engineering Research #Software Reliability and Analysis Research #cs.CR #cs.LG

paper · pdf · doi:10.48550/arxiv.2110.07317

Accepted to ICSE 2022 (Demonstrations). The first two authors contributed equally to this work

openalex publication_date 2021/10/14 · arxiv created 2022/02/05 · arxiv updated 2022/02/08 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Identifying vulnerabilities in the source code is essential to protect the software systems from cyber security attacks. It, however, is also a challenging step that requires specialized expertise in security and code representation. To this end, we aim to develop a general, practical, and programming language-independent model capable of running on various source codes and libraries without difficulty. Therefore, we consider vulnerability detection as an inductive text classification problem and propose ReGVD, a simple yet effective graph neural network-based model for the problem. In particular, ReGVD views each raw source code as a flat sequence of tokens to build a graph, wherein node features are initialized by only the token embedding layer of a pre-trained programming language (PL) model. ReGVD then leverages residual connection among GNN layers and examines a mixture of graph-level sum and max poolings to return a graph embedding for the source code. ReGVD outperforms the existing state-of-the-art models and obtains the highest accuracy on the real-world benchmark dataset from CodeXGLUE for vulnerability detection. Our code is available at: \urlhttps://github.com/daiquocnguyen/GNN-ReGVD.

Cited by

• NatGVD: Natural Adversarial Example Attack towards Graph-based Vulnerability Detection
• MulVuln: Enhancing Pre-trained LMs with Shared and Language-Specific Knowledge for Multilingual Vulnerability Detection
• Ensembling Large Language Models for Code Vulnerability Detection: An Empirical Evaluation
• VulAgent: Hypothesis-Validation based Multi-Agent Vulnerability Detection
• Weakly Supervised Vulnerability Localization via Multiple Instance Learning
• VULSOLVER: Vulnerability Detection via LLM-Driven Constraint Solving
• Deep Learning Based Concurrency Bug Detection and Localization
• Resource-Efficient Automatic Software Vulnerability Assessment via Knowledge Distillation and Particle Swarm Optimization
• It Only Gets Worse: Revisiting DL-Based Vulnerability Detectors from a Practical Perspective
• FuncVul: An Effective Function Level Vulnerability Detection Model using LLM and Code Chunk
• Today's Cat Is Tomorrow's Dog: Accounting for Time-Based Changes in the Labels of ML Vulnerability Detection Approaches
• AI-Based Software Vulnerability Detection: A Systematic Literature Review
• A Benchmark Dataset for Graph Regression with Homogeneous and Multi-Relational Variants
• Context-Enhanced Vulnerability Detection Based on Large Language Model
• Trace Gadgets: Minimizing Code Context for Machine Learning-Based Vulnerability Prediction

Related

• Learning to map source code to software vulnerability using code-as-a-graph
• Devign: Effective Vulnerability Identification by Learning Comprehensive Program Semantics via Graph Neural Networks
• Software Vulnerability Detection via Deep Learning over Disaggregated Code Graph Representation
• Detecting Code Vulnerabilities with Heterogeneous GNN Training
• Vulnerability Detection with Graph Simplification and Enhanced Graph Representation Learning