A software vulnerability intelligent detection method based on code association graph

In order to improve the accuracy of software source code vulnerability detection and reduce the false positive rate, this paper proposes a software vulnerability intelligent detection method based on code association graph(VDCAG). This method constructs a new and more comprehensive graph structure representation for software source code by adding different dependency edges in AST, known as a Code Association Graph (CAG). Furthermore, research has found that nodes with higher in and out degrees in the code association graph have higher importance in the code and are more likely to trigger vulnerabilities. Therefore, we have introduced a multi-channel attention mechanism in the vulnerability detection model, focusing on nodes that may trigger vulnerabilities and assigns them higher weights to guide the generation of the final graph embedding vector, thus completing fine-grained vulnerability detection. This paper conducted a comprehensive evaluation of our model on the SARD and NVD datasets, verifying the superiority of our proposed method.