Abstract:
Software vulnerabilities pose a serious threat to the safe and stable operation of computer systems and software, so the research related to their automatic detection has been receiving extensive attention. Unlike traditional static vulnerability detection tools that use predefined rules provided by human experts to analyze the code, graph neural network (GNN)-based vulnerability detection methods have surpassed the traditional methods in some datasets by automatically learning the vulnerable code patterns. However, in the current GNN-based vulnerability detection methods, the design of GNN model is not combined with the characteristics of the code itself, which leads to poor detection effect on the real vulnerability code dataset. In this paper, we propose a learnable hierarchical graph representation vulnerability detection method LHG-VD, which is characterized by proposing a learnable readout function for the limitation of the traditional readout function, and designing a cross-granularity loss function based on the idea of comparative learning for the problem of maintaining the local structural information of the code in the process of graph pooling. Experimental results on real vulnerability datasets show that the
F1 value of LHG-VD is 71.5%, which is improved by 4.9% compared with DeepWukong, a slice-level detection method, and 8.9% compared with AMPLE, a function-level detection method.