A Scalable Vulnerability Detection System with Multi-View Graph Representations

Deep learning (DL) has been extensively utilized in source code vulnerability detection due to its robust automatic feature extraction capabilities. To achieve scalable vulnerability scanning, some prior studies intend to process the source code directly by treating them as text. However, these text-based methods can not achieve the best performance due to the lack utilizing program semantics. In contrast, other approaches aim to enhance accuracy by distilling program semantics into graph representations for vulnerability detection. Despite their accuracy, these graph-based methods are not scalable, as graph analysis is generally time-intensive. In this paper, we aim to achieve both scalability and accuracy in scanning large-scale source code vulnerabilities. Inspired by existing DL-based image classification which has the ability to analyze millions of images accurately, we prefer to use these techniques to accomplish our purpose. Specifically, we propose an innovative approach that efficiently converts the source code of a function into multi-view images, while preserving the diverse program information from different perspectives. Based on this approach, we introduce a vulnerability detection system, VulCNN , which can leverage the function images and simple convolutional neural networks (CNN) to effectively and efficiently detect vulnerabilities. We implement VulCNN and evaluate it on three popular and widely used datasets ( ie., the Devign , Big-Vul , and ReVeal datasets). Experimental results report that VulCNN can achieve better accuracy than nine state-of-the-art vulnerability detectors ( ie., TokenCNN , VulDeePecker , SySeVR , VulDeeLocator , Devign , EPVD , VulDecgre , UniXcoder , and PDBERT ). We also compare VulCNN with three widely used Large Language Models ( ie., Llama-2-Instruct , DeepSeek-Coder , Qwen2.5-Coder-Instruct ) and one LLM-based detection method ( ie., GRACE ), and the experimental results demonstrate that our proposed method can perform better than most of vulnerability detection methods. As for scalability, VulCNN is about five times faster than VulDeeLocator , and about two times faster than Devign . VulCNN achieves vulnerability detection effectiveness comparable to the state-of-the-art method GRACE , but with a 31.52% reduction in time overhead.