A slice-level software vulnerability detection method based on hyperbolic gated graph neural network

Abstract

As technological progress drives software complexity, traditional vulnerability detection cannot meet rising security demands. AI-driven detection is now a trend. Recent research indicates deep learning can automate code semantic analysis for proactive risk identification and better detection efficiency. In deep learning-based vulnerability detection, graph-based source code representation prevails, capturing code structures better than sequence-based methods. But it fails to model tree-like dependency relationships well, resulting in poor feature extraction. To solve this, we propose a Slice-based Hyperbolic Gated graph neural network for Vulnerability Detection, named SHGvd. It first extracts key semantic features through normalization, graph slicing and embedding. Then it employs a novel Hyperbolic Gated Graph Neural Network that utilizes the negative curvature of hyperbolic space to enhance hierarchical code relation capture. Moreover, with a trainable curvature strategy, it can dynamically adjust the hyperbolic space curvature according to data. Finally, it employs convolutional, pooling layers, and multi-layer perceptrons for classification. Evaluated on Big-Vul, SHGvd outperforms existing models, achieving 80.55% accuracy and 81.37% F1-score, showing superior feature extraction.

Graphical abstract

Keywords

vulnerability detection / source code representation / graph neural network / hyperbolic space

References

[1] Aslan Ö, Aktuğ S S, Ozkan-Okay M, Yilmaz A A, Akin E . A comprehensive review of cyber security vulnerabilities, threats, attacks, and solutions. Electronics, 2023, 12( 6): 1333

[2] D. A. Wheeler. Flawfinder Static Vulnerability Scanner. Website at dwheeler.com/flawfinder/.

[3] Engineering S S. RATS: Rough Audit Tool for Security. Website at code.google.com/archive/p/rough-auditing-tool-for-security/.

[4] Liang C, Wei Q, Du J, Wang Y, Jiang Z . Survey of source code vulnerability analysis based on deep learning. Computers & Security, 2025, 148: 104098

[5] Li Z, Zou D, Xu S, Ou X, Jin H, Wang S, Deng Z, Zhong Y. VulDeePecker: a deep learning-based system for vulnerability detection. In: Proceedings of the 25th Annual Network and Distributed System Security Symposium. 2018

[6] Li Z, Zou D, Xu S, Jin H, Zhu Y, Chen Z . SySeVR: a framework for using deep learning to detect software vulnerabilities. IEEE Transactions on Dependable and Secure Computing, 2022, 19( 4): 2244–2258

[7] Guo D, Lu S, Duan N, Wang Y, Zhou M, Yin J. UniXcoder: unified cross-modal pre-training for code representation. In: Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 2022, 7212−7225

[8] Han J, Cen J, Wu L, Li Z, Kong X, Jiao R, Yu Z, Xu T, Wu F, Wang Z, Xu H, Wei Z, Zhao D, Liu Y, Rong Y, Huang W . A survey of geometric graph neural networks: data structures, models and applications. Frontiers of Computer Science, 2025, 19( 11): 1911375

[9] Nguyen V A, Nguyen D Q, Nguyen V, Le T, Tran Q H, Phung D. ReGVD: revisiting graph neural networks for vulnerability detection. In: Proceedings of the 44th IEEE/ACM International Conference on Software Engineering: Companion Proceedings (ICSE-Companion). 2022, 178−182

[10] Zhou Y, Liu S, Siow J, Du X, Liu Y. Devign: effective vulnerability identification by learning comprehensive program semantics via graph neural networks. In: Proceedings of the 33rd International Conference on Neural Information Processing Systems. 2019, 915

[11] Gong Y, Nie J, You W, Shi W, Huang J, Liang B, Zhang J. SICode: embedding-based subgraph isomorphism identification for bug detection. In: Proceedings of the 32nd IEEE/ACMInternational Conference on Program Comprehension. 2024, 304−315

[12] Feng S, Wu Y, Xue W, Pan S, Zou D, Liu Y, et al. FIRE: combining multi-stage filtering with taint analysis for scalable recurring vulnerability detection. In: Proceedings of the 33rd USENIX Security Symposium, USENIX Security 2024. 2024, 1867−1884

[13] Fan J, Li Y, Wang S, Nguyen T N. A C/C++ code vulnerability dataset with code changes and CVE summaries. In: Proceedings of the 17th International Conference on Mining Software Repositories. 2020, 508−512

[14] Neuhaus S, Zimmermann T, Holler C, Zeller A. Predicting vulnerable software components. In: Proceedings of the 14th ACM Conference on Computer and Communications Security. 2007, 529−540

[15] Shin Y, Meneely A, Williams L, Osborne J A . Evaluating complexity, code churn, and developer activity metrics as indicators of software vulnerabilities. IEEE Transactions on Software Engineering, 2011, 37( 6): 772–787

[16] Walden J, Stuckman J, Scandariato R. Predicting vulnerable components: software metrics vs text mining. In: Proceedings of the 25th IEEE International Symposium on Software Reliability Engineering. 2014, 23−33

[17] Grieco G, Grinblat G L, Uzal L, Rawat S, Feist J, Mounier L. Toward large-scale vulnerability discovery using machine learning. In: Proceedings of the 6th ACM Conference on Data and Application Security and Privacy. 2016, 85−96

[18] Dam H K, Tran T, Pham T, Ng S W, Grundy J, Ghose A . Automatic feature learning for predicting vulnerable software components. IEEE Transactions on Software Engineering, 2021, 47( 1): 67–85

[19] Alon U, Zilberstein M, Levy O, Yahav E . code2vec: learning distributed representations of code. Proceedings of the ACM on Programming Languages, 2019, 3( POPL): 40

[20] Feng Z, Guo D, Tang D, Duan N, Feng X, Gong M, Shou L, Qin B, Liu T, Jiang D, Zhou M. CodeBERT: a pre-trained model for programming and natural languages. In: Proceedings of Findings of the Association for Computational Linguistics: EMNLP 2020. 2020, 1536-1547

[21] Yamaguchi F, Golde N, Arp D, Rieck K. Modeling and discovering vulnerabilities with code property graphs. In: Proceedings of 2014 IEEE Symposium on Security and Privacy. 2014, 590−604

[22] Guo D, Ren S, Lu S, Feng Z, Tang D, et al. GraphCodeBERT: pre-training code representations with data flow. In: Proceedings of the 9th International Conference on Learning Representations. 2021

[23] Wang M, Tao C, Guo H . LCVD: loop-oriented code vulnerability detection via graph neural network. Journal of Systems and Software, 2023, 202: 111706

[24] Wen X C, Chen Y, Gao C, Zhang H, Zhang J M, Liao Q. Vulnerability detection with graph simplification and enhanced graph representation learning. In: Proceedings of the 45th IEEE/ACM 45th International Conference on Software Engineering (ICSE). 2023, 2275-2286

[25] Xiao P, Xiao Q, Zhang X, Wu Y, Yang F . Vulnerability detection based on enhanced graph representation learning. IEEE Transactions on Information Forensics and Security, 2024, 19: 5120–5135

[26] Steenhoek B, Rahman M M, Jiles R, Le W. An empirical study of deep learning models for vulnerability detection. In: Proceedings of the 45th International Conference on Software Engineering. 2023, 2237-2248

[27] Cai W, Chen J, Yu J, Hu W, Gao L . A software vulnerability detection method based on multi-modality with unified processing. Information and Software Technology, 2025, 182: 107703

[28] Wu Y, Zou D, Dou S, Yang W, Xu D, Jin H. VulCNN: an image-inspired scalable vulnerability detection system. In: Proceedings of the 44th IEEE/ACM International Conference on Software Engineering. 2022, 2365−2376

[29] Cai W, Chen J, Yu J, Gao L . A software vulnerability detection method based on deep learning with complex network analysis and subgraph partition. Information and Software Technology, 2023, 164: 107328

[30] Wang H, Ye G, Tang Z, Tan S H, Huang S, Fang D, Feng Y, Bian L, Wang Z . Combining graph-based learning with automated data collection for code vulnerability detection. IEEE Transactions on Information Forensics and Security, 2021, 16: 1943–1958

[31] Chakraborty S, Krishna R, Ding Y, Ray B . Deep learning based vulnerability detection: are we there yet?. IEEE Transactions on Software Engineering, 2022, 48( 9): 3280–3296

[32] Kong L, Luo S, Pan L, Wu Z, Li X . A multi-type vulnerability detection framework with parallel perspective fusion and hierarchical feature enhancement. Computers & Security, 2024, 140: 103787

[33] Li Y, Luo Q, Wu P, Zheng H . VDMAF: cross-language source code vulnerability detection using multi-head attention fusion. Information and Software Technology, 2025, 183: 107739

[34] Nguyen H Q, Hoang T, Dam H K, Ghose A . Graph-based explainable vulnerability prediction. Information and Software Technology, 2025, 177: 107566

[35] Chamberlain B P, Clough J, Deisenroth M P. Neural embeddings of graphs in hyperbolic space. 2017, arXiv preprint arXiv: 1705.10359

[36] Ratcliffe J G. Foundations of Hyperbolic Manifolds. Cham: Springer, 2019

[37] Nickel M, Kiela D. Poincaré embeddings for learning hierarchical representations. In: Proceedings of the 31st International Conference on Neural Information Processing Systems. 2017, 6341–6350

[38] Kim S, Woo S, Lee H, Oh H. VUDDY: a scalable approach for vulnerable code clone discovery. In: Proceedings of 2017 IEEE Symposium on Security and Privacy (SP). 2017, 595−614

[39] Chimalakonda S, Das D, Mathai A, Tamilselvam S, Kumar A. The landscape of source code representation learning in AI-driven software engineering tasks. In: Proceedings of the 45th IEEE/ACM International Conference on Software Engineering: Companion Proceedings (ICSE-Companion). 2023, 342−343

[40] Yamaguchi F, Community J. Joern: the bug hunter’s benchmark. Website at joern.io

[41] Wolf L, Hanani Y, Bar K, Dershowitz N . Joint word2vec networks for bilingual semantic representations. International Computer Linguistics Applications, 2014, 5( 1): 27–42

[42] Li Y, Tarlow D, Brockschmidt M, Zemel R. Gated graph sequence neural networks. 2015, arXiv preprint arXiv: 1511.05493

[43] Liu Q, Nickel M, Kiela D. Hyperbolic graph neural networks. In: Proceedings of the 33rd International Conference on Neural Information Processing Systems. 2019, 739

[44] Chami I, Ying Z, Re C, Leskovec J. Hyperbolic graph convolutional neural networks. In: Proceedings of the 33rd International Conference on Neural Information Processing Systems. 2019, 438

[45] Zhang Y, Wang X, Shi C, Jiang X, Ye Y . Hyperbolic graph attention network. IEEE Transactions on Big Data, 2022, 8( 6): 1690–1701

[46] Krioukov D, Papadopoulos F, Kitsak M, Vahdat A, Boguñá M . Hyperbolic geometry of complex networks. Physical Review E, 2010, 82: 036106

[47] Anon. Cve details: vulnerabilities-by-types. Website at www.cvedetails.com/vulnerabilities-by-types.php

[48] Kingma D P, Ba J. Adam: a method for stochastic optimization. 2014, arXiv preprint arXiv: 1412.6980

[49] Liu S, Lin G, Qu L, Zhang J, De Vel O, Montague P, Xiang Y . CD-VulD: cross-domain vulnerability discovery based on deep domain adaptation. IEEE Transactions on Dependable and Secure Computing, 2022, 19( 1): 438–451

[50] Li X, Xin Y, Zhu H, Yang Y, Chen Y . Cross-domain vulnerability detection using graph embedding and domain adaptation. Computers & Security, 2023, 125: 103017

[51] Dong Y, Tang Y, Cheng X, Yang Y, Wang S . SedSVD: statement-level software vulnerability detection based on relational graph convolutional network with subgraph embedding. Information and Software Technology, 2023, 158: 107168

[52] Nguyen T T, Vo H D . Context-based statement-level vulnerability localization. Information and Software Technology, 2024, 169: 107406

Rights & permissions

Higher Education Press