关键词: 源码漏洞检测, 代码属性图, 图神经网络, 中心性分析, 自注意力机制

Abstract: Existing deep learning-based methods for source code vulnerability detection often suffered from significant loss of syntax and semantics in target code, and neural network models allocated weights to the graph nodes and edges suboptimally. To address these issues, a novel method VulATGCN was proposed utilizing the Code Property Graph (CPG) and adaptive Transformer-Graph Convolutional Networks (AT-GCN) for detecting source code vulnerabilities. Initially, the CPG was used to represent source code, combined with CodeBERT for node vectorization. Graph centrality analysis was employed to extract deep structural features, enabling multi-dimensional capture of the code’s syntax and semantic information. Finally, AT-GCN model was designed to integrated the strengths of Transformer’s self-attention mechanism, which excels at capturing long-range dependencies, and Graph Convolutional Network (GCN), which is proficient at capturing local features. This design allowed for fusion learning and precise extraction of features from different important regions. Experiments conducted on real vulnerability datasets such as Big-Vul and SARD show that the F1 score reaches 82.9%, representing an average improvement of approximately 52.9% compared to deep learning-based vulnerability detection methods like VulSniper, VulMPFF, and MGVD.

Key words: code vulnerability detection, code property graph, graph neural network, centrality analysis, self-attention mechanism