One of the challenging issues for software developers is detecting vulnerabilities at different development stages. Security researchers are always seeking new methods to detect vulnerabilities more precisely in a short time. While there are many static and dynamic methods for detecting and discovering vulnerabilities, many of these approaches come with a high computational cost, which leads to inefficiencies, particularly in large-scale codebases. In recent years, deep learning has gained prominence in extracting vulnerability features from code without requiring direct intervention from cybersecurity experts.
This paper proposes a multi-class vulnerability detection scheme at both the line-level (LLVD) and function-level (FLVD) using graph neural networks, based on node-level and graph-level prediction models,, respectively. Moreover, by combining LLVD as a fine-grained approach with FLVD as a coarse-grained one, we propose a multi-granularity scheme called Function/Line-Level Vulnerability Detection (FLLVD) scheme. More specifically, it uses FLVD to detect the type of vulnerability while employing LLVD to identify its location in the source code. Our scheme's variants work with any abstraction graph extracted from incoming source code, such as Data Dependency Graph (DDG) and Program Dependency Graph (PDG).
We evaluate our schemes using both man-made and real-world datasets : SARD and BigVul. Particularly, LLVD and FLLVD achieve performance gains of 0.90 and 0.94, respectively, in terms of $F_1$ metrics for a subset of SARD with 20 vulnerability types. In contrast, for the combination of SARD and BigVul with 6 vulnerability types, LLVD and FLLVD have $F_1$ scores of approximately 0.76 and 0.82, respectively.