A General Source Code Vulnerability Detection Method via Ensemble of Graph Neural Networks

Deep neural networks have been recently utilized in source code vulnerability detection methods due to their automated feature learning capabilities. However, current deep vulnerability detection models heavily rely on fixed code static analysis tools, limiting their applicability to a single programming language. Furthermore, the existing models often fail to fully extract semantic features from the source code, leading to limited generalization capabilities. To address these challenges, this paper proposes a language-agnostic code vulnerability detection framework based on ensemble of graph neural networks. Our approach considers the source program as a linear token sequence and constructs an initial graph representation by capturing the co-occurrence relationships between tokens. The model’s hidden layers leverage a combination of graph convolutional module and gated graph neural networks to extract semantic features from vulnerable code. To adaptively learn the importance of each vulnerability feature, we introduce a self-attention layer after the hidden layer. Additionally, to enhance model stability and prevent overfitting, we incorporate residual connections and flooding regularization techniques. Experimental results on real-world vulnerability datasets demonstrate our approach surpasses previous SOTA approaches by a margin of over 2.37% in terms of detection accuracy.