Vulnerability detection with Graph Attention Network and Metric Learning

Abstract

Context:

Static code vulnerability detection is a critical topic in software security. Researchers are interested in employing deep learning to discover vulnerabilities automatically. However, existing software analysis methods have a high rate of false positives and false negatives.

Objective:

High false negatives and high false positives may be caused by the problem of insufficient extraction of syntax and semantics, data imbalance, and overlapping feature distributions. Based on the above problems, we construct a vulnerability detection model GSM, which is a loosely coupled method based on the combination of Graph Attention Network, Sampling, and Metric Learning.

Method:

Firstly, we utilize the code property graph to represent source code and use graph attention networks for graph embedding learning. Secondly, we adopt a combination of oversampling and undersampling to deal with imbalanced dataset. Finally, we adopt a Metric Learning method based on the quadruple loss function to separate vulnerable and neutral samples.

Results:

Compared to the state-of-the-art method Reveal on the imbalanced dataset chrdeb, the performance of Precision, Recall, and F1-Score are improved by about 11.5%, 12.4%, and 12.7%, respectively.

Conclusion:

Under different datasets, GSM has shown better performance than state-of-the-art vulnerability detection methods in multiple metrics. GSM can resolve the problem of data imbalance and the inability to separate the two types of samples.