Combining Graph-Based Learning With Automated Data Collection for Code Vulnerability Detection

TLDR

Prior vulnerability detection methods treat code as sequences or untyped graphs, whereas this work uses a graph representation of source code with relational edges. The study introduces FUNDED, a learning framework for constructing vulnerability detection models. FUNDED employs graph neural networks to model control, data, and call dependencies, automatically collects training samples from open-source projects, and is evaluated on large real‑world datasets across multiple languages. FUNDED achieves significantly better vulnerability detection performance than six state‑of‑the‑art models, benefiting from richer code representations and abundant training samples.

Abstract

This paper presents FUNDED (Flow-sensitive vUl-Nerability coDE Detection), a novel learning framework for building vulnerability detection models. Funded leverages the advances in graph neural networks (GNNs) to develop a novel graph-based learning method to capture and reason about the program's control, data, and call dependencies. Unlike prior work that treats the program as a sequential sequence or an untyped graph, Funded learns and operates on a graph representation of the program source code, in which individual statements are connected to other statements through relational edges. By capturing the program syntax, semantics and flows, Funded finds better code representation for the downstream software vulnerability detection task. To provide sufficient training data to build an effective deep learning model, we combine probabilistic learning and statistical assessments to automatically gather high-quality training samples from open-source projects. This provides many real-life vulnerable code training samples to complement the limited vulnerable code samples available in standard vulnerability databases. We apply Funded to identify software vulnerabilities at the function level from program source code. We evaluate Funded on large real-world datasets with programs written in C, Java, Swift and Php, and compare it against six state-of-the-art code vulnerability detection models. Experimental results show that Funded significantly outperforms alternative approaches across evaluation settings.