A Method to Detect Vulnerability of Java Source Code based on AST and Graph Attention Networks

It is crucial to Detecting vulnerabilities in source code at the beginning of projects. Traditional source code vulnerability detection algorithms are hard to represent the feature information and the relationships between code blocks. To address these issues, this paper uses abstract syntax tree to represent the feature of source code. This paper adds data dependency edges and control dependency edges to the original AST, transforming the tree-structured AST into a graph-structured Enhanced-AST in order to solve the limited ability of the original AST to represent data flow and control flow. Word2Vec algorithm is used for embedding Enhanced-AST nodes, and Graph Attention Networks (GAT), which introduces an attention mechanism to better capture the dependencies and important information between nodes, are used to learn the feature information of Enhanced-AST. This paper collects Java CWE vulnerability datasets from the SARD dataset, implements a function-level vulnerability detection method based on the dataset, and compares it with BiLSTM and method using AST to extract code features. Experimental results show that the proposed method achieves optimal F1 values in most cases.