MGVul: a Multi-Granularity Detection Framework for Software Vulnerability

Source code vulnerability detection is a critical issue in software security. Existing detection methods primarily focus on the function-granularity, neglecting inter-function call information and lacking the ability to detect inter-function vulnerability. The isolation of functions is one of the reasons that limits the performance of deep learning models. In this work, we propose MGVul: a Multi-granularity detection framework for software vulnerability. This framework treats a project as a whole graph, files as subgraphs, functions as nodes, and function call relationships as edges. By using a multi-expert mixture graph neural network to learn inter-function call information, it not only improves the model’s detection performance at the function-granularity but also is capable of handling detection tasks at the file-granularity and project-granularity. Preliminary evaluation shows that introducing inter-function call relationships bring an average F1-score improvement of 7.99% for function-level detection. Meanwhile, our framework also shows promising results at both the file-granularity and the project-granularity. The source code will be released upon paper acceptance.