Applying GNN for Source Code Analysis: vulnerability detection

Abstract

The growing size and complexity of current software systems have made security holes more com- mon and more serious, especially in programming languages like C and C++ that are used at the system level. Static Application Security Testing tools and other traditional ways of automatically finding vulnerabilities depend a lot on rules and heuristics that people make by looking at known vulnerability patterns. These methods work well for finding some well-known bugs, but they have some major problems, including as high false-positive rates, limited ability to generalize to new bugs, and not enough understanding of how programs behave. Recent deep learning techniques that analyze source code as a linear sequence of tokens have shown potential; however, they naturally overlook essential structural information pertaining to syntax, control flow, and data dependencies. This thesis tackles these shortcomings by exploring a graph-based framework for source code analysis that accurately reflects the inherent structure of programs and facilitates learning-based reasoning regarding intricate, non-local interactions. The fundamental assertion of this study is that software vulnerabilities arise from the interplay among syntactic expressions, execution pathways, and data flows, rather than from discrete code segments. So, for automatic detection to work well, there needs to be a representation that can clearly model these interactions. For this purpose, the thesis uses the Code Property Graph as a single representation that com- bines the Abstract Syntax Tree, Control-Flow Graph, and Data-Flow Graph into one graph structure that is not uniform. This approach keeps grammatical hierarchy, execution semantics, and variable lifecycle information in a clear analytical framework. By incorporating these intricate structural linkages directly into the input space, the analysis transcends superficial pattern matching, advancing towards a more semantically nuanced comprehension of program behavior.