Devign: Effective Vulnerability Identification by Learning Comprehensive Program Semantics via Graph Neural Networks

Vulnerability identification is crucial to protect the software systems from for cyber security. It is especially important to localize the functions among the source code to facilitate the fix. However, it a challenging and tedious process, and also requires specialized security. Inspired by the work on manually-defined patterns of vulnerabilities various code representation graphs and the recent advance on graph neural, we propose Devign, a general graph neural network based model for-level classification through learning on a rich set of code semantic. It includes a novel Conv module to efficiently extract useful in the learned rich node representations for graph-level. The model is trained over manually labeled datasets built on 4 large-scale open-source C projects that incorporate high complexity variety of real source code instead of synthesis code used in previous. The results of the extensive evaluation on the datasets demonstrate that outperforms the state of the arts significantly with an average of10. 51% higher accuracy and 8. 68\\% F1 score, increases averagely 4. 66% accuracy 6. 37% F1 by the Conv module.