An empirical study on the impact of graph representations for code vulnerability detection using graph learning

The increasing complexity of software systems has necessitated more sophisticated security measures, particularly in the domain of vulnerability detection. Traditional machine learning (ML) and deep learning (DL) techniques often fall short when source code is treated merely as text, prompting a shift toward graph learning methods that leverage specific graph representations of code to enhance detection capabilities. These representations, including Abstract Syntax Tree (AST), Control Flow Graph (CFG), Data Flow Graph (DFG), Program Dependence Graph (PDG), and Code Property Graph (CPG), encapsulate the structural and semantic intricacies of programming code, offering a robust framework for identifying vulnerabilities. Despite advances in this field, a comprehensive understanding of the impact that each graph representation has on the effectiveness of vulnerability detection is still lacking. Our paper introduces a general architecture for a graph-based vulnerability detection system and conducts empirical studies on two real-world datasets, BigVul and FUNDED. This research systematically assesses how variations in graph representations—AST, CFG, DFG, PDG, and CPG—affect the efficacy of software vulnerability detection, providing pivotal insights that could guide future research and enhance practical applications in cybersecurity.