Graph neural networks of improved code attribute graph for software vulnerability detection

In view of the problems of coarse detection granularity and loss of syntactic or semantic information in the current deep learning software vulnerability detection methods, Vulnerability Detection with Code Property Graphs(VDCPG) is proposed, a graph neural network software vulnerability model based on the improved Code Property Graphs(CPG). VDCPG uses the Joern to generate the CPG which can accurately capture the syntactic and semantic information of the objective function. Based on the depth-first traversal, a CPG optimization algorithm is proposed to dynamically remove the edges of the control flow graphs or the control dependence graphs, so as to improve the detection efficiency without sacrificing the vulnerability detection effect. The generated CPG is vectorized by the word2vec under the Continuous Bag Of Words(CBOW) mode. The Graph Attention Networks(GAT) with self-attention mechanism is finally used to achieve efficient and accurate detection of software vulnerabilities. The test results of two data sets of different sizes show that the vulnerability detection effect of VDCPG is significantly improved compared with the existing software vulnerability detection tools and models.