A multi-class Function/Line Level Vulnerability Detection using Graph Neural Networks

Taheri, Hamidreza M.; Shafieinejad, Alireza

doi:10.22042/isecure.2026.557140.1267

A multi-class Function/Line Level Vulnerability Detection using Graph Neural Networks

Document Type : Research Article

Authors

Hamidreza M. Taheri

Alireza Shafieinejad

Department of Electrical and Computer Engineering, Tarbiat Modares University, Tehran, Iran

https://doi.org/10.22042/isecure.2026.557140.1267

Abstract

One of the challenging issues for software developers is detecting vulnerabilities at different development stages. Security researchers are always seeking new methods to detect vulnerabilities more precisely in a short time. While there are many static and dynamic methods for detecting and discovering vulnerabilities, many of these approaches come with a high computational cost, which leads to inefficiencies, particularly in large-scale codebases. In recent years, deep learning has gained prominence in extracting vulnerability features from code without requiring direct intervention from cybersecurity experts. This paper proposes a multi-class vulnerability detection scheme at both the line-level (LLVD) and function-level (FLVD) using graph neural networks, based on node-level and graph-level prediction models, respectively. Moreover, by combining LLVD as a fine-grained approach with FLVD as a coarse-grained one, we propose a multi-granularity scheme called Function/Line-Level Vulnerability Detection (FLLVD) scheme. More specifically, it uses FLVD to detect the type of vulnerability while employing LLVD to identify its location in the source code. Our scheme’s variants work with any abstraction graph extracted from incoming source code, such as Data Dependency Graph (DDG) and Program Dependency Graph (PDG). We evaluate our schemes using both man-made and real-world datasets: SARD and BigVul. Particularly, LLVD and FLLVD achieve performance gains of 0.90 and 0.94, respectively, in terms of F1 metrics for a subset of SARD with 20 vulnerability types. In contrast, for the combination of SARD and BigVul with 6 vulnerability types, LLVD and FLLVD have F1 scores of approximately 0.76 and 0.82, respectively.

Keywords

Vulnerability Detection

Line-Level Vulnerability Detection

Multi-granularity Detection

Static Analysis

Deep Learning

Graph Neural Network

20.1001.1.20082045.2026.18.2.6.6

[1] Yaqin Zhou, Shangqing Liu, Jingkai Siow, Xiaoning Du, and Yang Liu. Devign: Effective vulnerability identification by learning comprehensive program semantics via graph neural networks. Advances in neural information processing systems, 32, 2019.

[2] Zhang Haojie, Li Yujun, Liu Yiwei, and Zhou Nanxin. Vulng: A static detection solution for source code vulnerabilities based on code property graph and graph attention network. In 2021 18th International Computer Conference on Wavelet Active Media Technology and Information Processing (ICCWAMTIP), pages 250–255. IEEE, 2021.

[3] Hongyu Yang, Haiyun Yang, Liang Zhang, and Xiang Cheng. Source Code Vulnerability Detection Using Vulnerability Dependency Representation Graph. In 2022 IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), pages 457–464. IEEE, 2022.

[4] Michael Fu, Van Nguyen, Chakkrith Kla Tanthithanhavorn, Trung Le, and Dinh Phung. Vulexplainer: A transformer-based hierarchical distillation for explaining vulnerability types. IEEE Transactions on Software Engineering, 2023.

[5] Wei Tang, Mingwei Tang, Minchao Ban, Ziguo Zhao, and Mingjun Feng. Csgvd: A deep learning approach combining sequence and graph embedding for source code vulnerability detection. Journal of Systems and Software, 199:111623, 2023.

[6] Chunyong Zhang and Yang Xin. Static vulnerability detection based on class separation. Journal of Systems and Software, 206:111832, 2023.

[7] Mingwei Tang, Wei Tang, Qingchi Gui, Jie Hu, and Mingfeng Zhao. A vulnerability detection algorithm based on residual graph attention networks for source code imbalance (rgan). Expert Systems with Applications, 238:122216, 2024.

[8] Zhen Li, Deqing Zou, Shouhuai Xu, Xinyu Ou, Hai Jin, Sujuan Wang, Zhijun Deng, and Yuyi Zhong. Vuldeepecker: A deep learning-based system for vulnerability detection. arXiv preprint arXiv:1801.01681, 2018.

[9] Zhen Li, Deqing Zou, Shouhuai Xu, Hai Jin, Yawei Zhu, and Zhaoxuan Chen. Sysevr: A framework for using deep learning to detect software vulnerabilities. IEEE Transactions on Dependable and Secure Computing, 19(4):2244–2258, 2021.

[10] Deqing Zou, Sujuan Wang, Shouhuai Xu, Zhen Li, and Hai Jin. μVulDeePecker: A Deep Learning-Based System for Multiclass Vulnerability Detection. IEEE Transactions on Dependable and Secure Computing, 18(5):2224–2236, 2021.

[11] Son Nguyen, Thu-Trang Nguyen, Thanh Trong Vu, Thanh-Dat Do, Kien-Tuan Ngo, and Hieu Dinh Vo. Code-centric learning-based just in-time vulnerability detection. Journal of Systems and Software, page 112014, 2024.

[12] Zhen Li, Deqing Zou, Shouhuai Xu, Zhaoxuan Chen, Yawei Zhu, and Hai Jin. Vuldeelocator: a deep learning-based fine-grained vulnerability detector. IEEE Transactions on Dependable and Secure Computing, 19(4):2821–2837, 2021.

[13] Deqing Zou, Yutao Hu, Wenke Li, Yueming Wu, Haojun Zhao, and Hai Jin. mvulpreter: A multi-granularity vulnerability detection system with interpretations. IEEE Transactions on Dependable and Secure Computing, 2022.

[14] Bolun Wu, Futai Zou, Ping Yi, Yue Wu, and Liang Zhang. Slicedlocator: Code vulnerability locator based on sliced dependence graph. Computers & Security, 134:103469, 2023.

[15] Chunyong Zhang and Yang Xin. VulGAI: vulnerability detection based on graphs and images. Computers & Security, 135:103501, 2023.

[16] Miles Q Li, Benjamin CM Fung, and Ashita Diwan. A Novel Deep Multi-head Attentive Vulnerable Line Detector. Procedia Computer Science, 222:35–44, 2023.

[17] Haibin Zhang, Yifei Bi, Hongzhi Guo, Wen Sun, and Jianpeng Li. ISVSF: Intelligent vulnerability detection against java via sentence-level pattern exploring. IEEE Systems Journal, 16(1):1032– 1043, 2021.

[18] David Hin, Andrey Kan, Huaming Chen, and M Ali Babar. Linevd: Statement-level vulnerability detection using graph neural networks. In Proceedings of the 19th international conference on mining software repositories, pages 596–607, 2022.

[19] Yukun Dong, Yoer Tang, Xiaotong Cheng, Yufei Yang, and Shuqi Wang. SedSVD: Statement-level software vulnerability detection based on Relational Graph Convolutional Network with subgraph embedding. Information and Software Technology, 158:107168, 2023.

[20] Nicholas Saccente, Josh Dehlinger, Lin Deng, Suranjan Chakraborty, and Yin Xiong. Project achilles: A prototype tool for static method-level vulnerability detection of Java source code using a recurrent neural network. In 2019 34th IEEE/ACM International Conference on Automated Software Engineering Workshop (ASEW), pages 114–121. IEEE, 2019.

[21] Ana Fidalgo, Ibéria Medeiros, Paulo Antunes, and Nuno Neves. Towards a deep learning model for vulnerability detection on web application variants. In 2020 IEEE International Conference on Software Testing, Verification and Validation Workshops (ICSTW), pages 465–476. IEEE, 2020.

[22] Xiao Cheng, Haoyu Wang, Jiayi Hua, Guoai Xu, and Yulei Sui. Deepwukong: Statically detecting software vulnerabilities using deep graph neural network. ACM Transactions on Software Engineering and Methodology (TOSEM), 30(3):1–33, 2021.

[23] G Renjith and S Aji. Vulnerability Analysis and Detection Using Graph Neural Networks for Android Operating System. In Information Systems Security: 17th International Conference, ICISS 2021, Patna, India, December 16–20, 2021, Proceedings 17, pages 57–72. Springer, 2021.

[24] Sicong Cao, Xiaobing Sun, Lili Bo, Ying Wei, and Bin Li. Bgnn4vd: Constructing bidirectional graph neural network for vulnerability detection. Information and Software Technology, 136:106576, 2021.

[25] Yueming Wu, Deqing Zou, Shihan Dou, Wei Yang, Duo Xu, and Hai Jin. VulCNN: An Image-inspired Scalable Vulnerability Detection System. 2022.

[26] Rebecca Russell, Louis Kim, Lei Hamilton, Tomo Lazovich, Jacob Harer, Onur Ozdemir, Paul Ellingwood, and Marc McConley. Automated vulnerability detection in source code using deep representation learning. In2018 17th IEEE international conference on machine learning and applications (ICMLA), pages 757–762. IEEE, 2018.

[27] Laura Wartschinski, Yannic Noller, Thomas Vogel, Timo Kehrer, and Lars Grunske. VUDENC: vulnerability detection with deep learning on a natural codebase for python. Information and Software Technology, 144:106809, 2022.

[28] Benjamin Steenhoek, Md Mahbubur Rahman, Richard Jiles, and Wei Le. An empirical study of deep learning models for vulnerability detection. In 2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE), pages 2237–2248. IEEE, 2023.

[29] Chenyuan Zhang, Hao Liu, Jiutian Zeng, Kejing Yang, Yuhong Li, and Hui Li. Prompt-enhanced software vulnerability detection using chatgpt. In Proceedings of the 2024 IEEE/ACM 46th International Conference on Software Engineering: Companion Proceedings, pages 276–277, 2024.

[30] Cho Do Xuan, Dat Bui Quang, and Vinh Dang Quang. A novel approach for software vulnerability detection based on ensemble learning model. Computers and Electrical Engineering, 130:110848, 2026.

[31] Abdechakour Mechri, Mohamed Amine Ferrag, and Merouane Debbah. Secureqwen: Leveraging llms for vulnerability detection in python codebases. Computers & Security, 148:104151, 2025.

[32] Aleksei Shestov, Rodion Levichev, Ravil Mussabayev, Evgeny Maslov, Pavel Zadorozhny, Anton Cheshkov, Rustam Mussabayev, Alymzhan Toleu, Gulmira Tolegen, and Alexander Krassovitskiy. Finetuning large language models for vulnerability detection. IEEE Access, 2025.

[33] Yujia Li, Daniel Tarlow, Marc Brockschmidt, and Richard Zemel. Gated graph sequence neural networks. arXiv preprint arXiv:1511.05493, 2015.

[34] Martin Simonovsky and Nikos Komodakis. Dynamic edge-conditioned filters in convolutional neural networks on graphs. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 3693–3702, 2017.

[35] https://huggingface.co/neulab/codebert cpp. Hugging face: Codebert c++ pretrained model, 2024. URL https://huggingface.co/neulab/codebert-cpp. Accessed: 2024-9-20.

[36] https://joern.io. Joern, the bug hunter's workbench, 2024. URL https://joern.io. Accessed: 2024-9-20.

[37] Guru Bhandari, Amara Naseer, and Leon Moonen. Cvefixes: automated collection of vulnerabilities and their fixes from open-source software. In Proceedings of the 17th International Conference on Predictive Models and Data Analytics in Software Engineering, pages 30–39, 2021.