Vulnerability Detection With Graph Attention Network And Metric Learning

Abstract

Static code vulnerability detection is a critical topic in software security. Existing software analysis methods have a high rate of false positives and false negatives. Researchers are interested in employing deep learning to discover vulnerabilities automatically, thanks to the recent success of deep learning algorithms in other application domains.This paper aims at the problem of insufficient and effective extraction of syntax and semantics, the issue of data imbalance, and the problem of overlapping feature distributions between vulnerable and non-vulnerable samples. We illustrate how to create models in a more principled way. We build GSM, a systematic vulnerability detection model based on Graph Attention Network, Sampling methods, and Metric Learning, one phase for one problem solution. When compared to the state-of-the-art approaches, our method achieves 11.5%, 12.3%, 12.57%, and 7.90% improvement in Precision, Recall, F1-Score, and AUC, respectively. Finally, based on the methods proposed in each stage of this paper, we put forward directions and suggestions for more efficient vulnerability detection tasks in the following research.

Structural Information Enhanced Graph Representation for Link Prediction

“…In addition, Self-attention calculates the similarity between all nodes pairwise, resulting in a quadratic computational complexity. To alleviate this problem, methods (Dwivedi and Bresson 2020;Zhang et al 2020a) limit the number of nodes involved in computation through sampling. However, the sampling strategies are still node-centric rather than link-centric.…”

A New Framework for Software Vulnerability Detection Based on an Advanced Computing

“…It can be seen that traditional approaches use only graph networks to extract CPG. Zhang et al [38] proposed a combined model of the Graph Attention Network and Metric Learning to extract and classify source code vulnerabilities based on CPG. Consequently, he used a Graph Attention Network to extract information of the source code based on CPG and used Metric Learning for classification.…”