A Vulnerability Detection Framework Based on Graph Decomposition Fusion and Augmented Abstract Syntax Tree

Nowadays, the method of using deep learning models for vulnerability detection is widely applied. Most of the methods convert the code of the program into a graph, and then use graph learning methods to get features. Although these methods have shown good accuracy in vulnerability detection, there are still some issues to be addressed: (1) When dealing with large scale functions or long codes, graph-based feature extraction methods will discard some features to meet the model input length limit. (2) Many deep learning methods convert code into code property graph (CPG). Since CPG contains a lot of function information, the model needs to extract information related to vulnerability characteristics from a lot of irrelevant information. To mitigate these issues, we use CPG's composite view approach and use augmented abstract syntax trees. Specifically, the input source code is used to build the CPG, and the abstract syntax tree AST (tree view) is decomposed from the CPG, and then the AST constructs a graph based on the augmented AST and uses GraphCodeBERT to extract its features. Flow view includes control flow graph (CFG) and program dependency graph (PDG) extracted from CPG, and these graphs are extracted and fused for features. Finally, CNN is used to fuse the graph features obtained from tree view and flow view, and finally perform vulnerability classification detection.