E-GVD: Efficient Software Vulnerability Detection Techniques Based on Graph Neural Network

Haiye Wang; Zhiguo Qu; Le Sun

doi:10.4108/eetsis.5056

Authors

Haiye Wang Nanjing University of Information Science and Technology
Zhiguo Qu Nanjing University of Information Science and Technology
Le Sun Nanjing University of Information Science and Technology

DOI:

https://doi.org/10.4108/eetsis.5056

Keywords:

vulnerability detection, graph neural network, pre-trained model, interpretable machine learning

Abstract

INTRODUCTION: Vulnerability detection is crucial for preventing severe security incidents like hacker attacks, data breaches, and network paralysis. Traditional methods, however, face challenges such as low efficiency and insufficient detail in identifying code vulnerabilities.
OBJECTIVES: This paper introduces E-GVD, an advanced method for source code vulnerability detection, aiming to address the limitations of existing methods. The objective is to enhance the accuracy of function-level vulnerability detection and provide detailed, understandable insights into the vulnerabilities.
METHODS: E-GVD combines Graph Neural Networks (GNNs), which are adept at handling graph-structured data, with residual connections and advanced Programming Language (PL) pre-trained models.
RESULTS: Experiments conducted on the real-world vulnerability dataset CodeXGLUE show that E-GVD significantly outperforms existing baseline methods in detecting vulnerabilities. It achieves a maximum accuracy gain of 4.98%, indicating its effectiveness over traditional methods.
CONCLUSION: E-GVD not only improves the accuracy of vulnerability detection but also contributes by providing fine-grained explanations. These explanations are made possible through an interpretable Machine Learning (ML) model, which aids developers in quickly and efficiently repairing vulnerabilities, thereby enhancing overall software security.

References

Shu, J., Jia, X., Yang, K. and Wang, H. (2018) Privacy-preserving task recommendation services for crowdsourcing. IEEE Transactions on Services Computing 14(1): 235–247.

Patil, D.R. and Pattewar, T.M. (2022) Majority voting and feature selection based network intrusion detection system. EAI Endorsed Transactions on Scalable Information Systems 9(6): e6–e6.

Ge, Y.F., Wang, H., Bertino, E., Zhan, Z.H., Cao, J., Zhang, Y. and Zhang, J. (2023) Evolutionary dynamic database partitioning optimization for privacy and utility. IEEE Transactions on Dependable and Secure Computing .

Venkateswaran, N. and Prabaharan, S.P. (2022) An efficient neuro deep learning intrusion detection system for mobile adhoc networks. EAI Endorsed Transactions on Scalable Information Systems 9(6): e7–e7.

Jordan, M.I. and Mitchell, T.M. (2015) Machine learning: Trends, perspectives, and prospects. Science 349(6245): 255–260.

LeCun, Y., Bengio, Y. and Hinton, G. (2015) Deep learning. nature 521(7553): 436–444.

Qu, Z., Tang, Y., Muhammad, G. and Tiwari, P. (2023) Privacy protection in intelligent vehicle networking: A novel federated learning algorithm based on information fusion. Information Fusion 98: 101824.

Tawhid, M.N.A., Siuly, S.,Wang, K. andWang, H. (2023) Automatic and efficient framework for identifying multiple neurological disorders from eeg signals. IEEE Transactions on Technology and Society 4(1): 76–86.

Singh, R., Subramani, S., Du, J., Zhang, Y., Wang, H., Miao, Y. and Ahmed, K. (2023) Antisocial behavior identification from twitter feeds using traditional machine learning algorithms and deep learning. EAI Endorsed Transactions on Scalable Information Systems 10(4): e17–e17.

Qu, Z., Liu, X. and Sun, L. (2022) Learnable antinoisereceiver algorithm based on a quantum feedforward neural network in optical quantum communication. Physical Review A 105(5): 052427.

Liu, F., Zhou, X., Cao, J., Wang, Z., Wang, T., Wang, H. and Zhang, Y. (2020) Anomaly detection in quasi-periodic time series based on automatic data segmentation and attentional lstm-cnn. IEEE Transactions on Knowledge and Data Engineering 34(6): 2626–2640.

Wang, H., Ye, G., Tang, Z., Tan, S.H., Huang, S., Fang, D., Feng, Y. et al. (2020) Combining graphbased learning with automated data collection for code vulnerability detection. IEEE Transactions on Information Forensics and Security 16: 1943–1958.

Li, Z., Zou, D., Xu, S., Jin, H., Zhu, Y. and Chen, Z. (2021) Sysevr: A framework for using deep learning to detect software vulnerabilities. IEEE Transactions on Dependable and Secure Computing 19(4): 2244–2258.

Rathore, H., Sharma, S.C., Sahay, S.K. and Sewak, M. (2022) Are malware detection classifiers adversarially vulnerable to actor-critic based evasion attacks? EAI Endorsed Transactions on Scalable Information Systems 10(1).

Jiang, F., Cao, Y., Xiao, J., Yi, H., Lei, G., Liu, M., Deng, S. et al. (2022) Vddl: A deep learning-based vulnerability detection model for smart contracts. In International Conference on Machine Learning for Cyber Security (Springer): 72–86.

Zhu, Z. andWang, S. (2023) Odet: Optimized deep elmbased transfer learning for breast cancer explainable detection. EAI Endorsed Transactions on Scalable Information Systems 10(2): e4–e4.

Kumar, S.B. and Pande, S.D. (2024) Explainable neural network analysis on movie success prediction. EAI Endorsed Transactions on Scalable Information Systems.

Geng, Y. (2021) Self-organizing incremental and graph convolution neural network for english implicit discourse relation recognition. EAI Endorsed Transactions on Scalable Information Systems 9(36).

Qu, Z., Liu, X. and Zheng, M. (2022) Temporal-spatial quantum graph convolutional neural network based on schrödinger approach for traffic congestion prediction. IEEE Transactions on Intelligent Transportation Systems .

Ni, M., Song, Y., Wang, G., Feng, L., Li, Y., Yan, L., Li, D. et al. (2023) Mied: An improved graph neural network for node embedding in heterogeneous graphs. EAI Endorsed Transactions on Scalable Information Systems 10(6).

Cui, L., Hao, Z., Jiao, Y., Fei, H. and Yun, X. (2020) Vuldetector: Detecting vulnerabilities using weighted feature graph comparison. IEEE Transactions on Information Forensics and Security 16: 2004–2017.

Cao, S., Sun, X., Bo, L., Wei, Y. and Li, B. (2021) Bgnn4vd: Constructing bidirectional graph neuralnetwork for vulnerability detection. Information and Software Technology 136: 106576.

Yin, J., Tang, M., Cao, J., You, M.,Wang, H. and Alazab, M. (2022) Knowledge-driven cybersecurity intelligence: Software vulnerability coexploitation behavior discovery. IEEE transactions on industrial informatics 19(4): 5593–5601.

Wang, S., Huang, C., Yu, D. and Chen, X. (2023) Vulgrab: Graph-embedding-based code vulnerability detection with bi-directional gated graph neural network. Software: Practice and Experience .

Ying, Z., Bourgeois, D., You, J., Zitnik, M. and Leskovec, J. (2019) Gnnexplainer: Generating explanations for graph neural networks. Advances in neural information processing systems 32.

Microsoft, Codexglue: Defect-detection, Available online: https://github.com/microsoft/CodeXGLUE/ tree/main/Code-Code/Defect-detection (accessed on 16 January 2024).

Huang, Z., Xu, W. and Yu, K. (2015) Bidirectional lstm-crf models for sequence tagging. arXiv preprint arXiv:1508.01991 .

Kim, Y. (2014) Convolutional neural networks for sentence classification. arXiv preprint arXiv:1408.5882 .

Liu, Y., Ott, M., Goyal, N., Du, J., Joshi, M., Chen, D., Levy, O. et al. (2019) Roberta: A robustly optimized bert pretraining approach. arXiv preprint arXiv:1907.11692 .

Feng, Z., Guo, D., Tang, D., Duan, N., Feng, X., Gong, M., Shou, L. et al. (2020) Codebert: A pre-trained model for programming and natural languages. arXiv preprint arXiv:2002.08155 .

Guo, D., Ren, S., Lu, S., Feng, Z., Tang, D., Liu, S., Zhou, L. et al. (2020) Graphcodebert: Pre-training code representations with data flow. arXiv preprint arXiv:2009.08366 .

Zhou, Y., Liu, S., Siow, J., Du, X. and Liu, Y. (2019) Devign: Effective vulnerability identification by learning comprehensive program semantics via graph neural networks. Advances in neural information processing systems 32.