Incorporating Domain Knowledge into GNNs for Advanced Vulnerability Detection in Java

In recent years, security testing and vulnerability detection in source code have experienced a significant transformation with the adoption of data-driven techniques. This shift has reduced reliance on manual analysis, addressed the high false-positive rates of static analyzers, and accelerated the early detection of software bugs, ultimately mitigating the risk of cyberattacks. Among these advancements, graph-based approaches have shown promising results by capturing structural and contextual patterns within source code. However, such methods often rely solely on the code under analysis, limiting their ability to comprehensively learn vulnerable patterns.This study explores the integration of domain-specific knowledge into a Graph Neural Network (GNN)–based model to enhance its understanding and detection of vulnerabilities. By incorporating resources such as Common Vulnerability Exposure (CVE) descriptions, Common Weakness Enumeration (CWE) definitions, and sample functions provided by security experts at the MITRE Corporation, we aim to enrich the model’s knowledge base. Our approach demonstrates significant improvements on a Java vulnerability dataset across all considerable metrics. This finding underscores the value of domain-specific augmentation in advancing vulnerability detection capabilities.