A Source Code Vulnerability Detection Method Based on Adaptive Graph Neural Networks
Open Access
- 27 October 2024
- conference paper
- Published by Association for Computing Machinery (ACM)
- p. 187-196
Abstract
This paper proposes a mobile application vulnerability detection method based on Code Property Graphs (CPG) and adaptive graph neural networks. The method first converts source code into CPGs, then uses CodeBERT to vectorize CPG nodes. Subsequently, high-level graph features are extracted through graph centrality analysis, and an adaptive graph neural network model combining Transformer's adaptive attention mechanism and Graph Convolutional Networks (GCN) is designed for feature learning and vulnerability detection. Experimental results show that this method achieves an F1 score of 82.9% on real vulnerability datasets, an improvement of 13.6%-49.9% compared to existing methods. Ablation experiments further validate the effectiveness of each key component. This research provides new insights and effective methods based on deep learning for mobile application security, demonstrating high application value and practical significance.Keywords
This publication has 12 references indexed in Scilit:
- Data Quality for Software Vulnerability Datasets2023
- Cross-domain vulnerability detection using graph embedding and domain adaptationComputers & Security, 2022
- DeepWukongACM Transactions on Software Engineering and Methodology, 2021
- μVulDeePecker: A Deep Learning-Based System for Multiclass Vulnerability DetectionIEEE Transactions on Dependable and Secure Computing, 2019
- Deep packet: a novel approach for encrypted traffic classification using deep learningSoft Computing, 2019
- Impact assessment for vulnerabilities in open-source software libraries2015
- Modeling and Discovering Vulnerabilities with Code Property Graphs2014
- An Empirical Study of the Evolution of PHP Web Application Security2011
- Use of relative code churn measures to predict system defect density2005
- A Complexity MeasureIEEE Transactions on Software Engineering, 1976