Detecting Rust Code Vulnerabilities Through Transfer Learning

Rust is designed to prevent common memory safety issues, yet it remains susceptible to various security vulnerabilities. The limited availability of labeled vulnerability data in Rust presents a significant challenge for applying machine learning (ML) techniques. To address this, we propose TL-HGNN, a novel transfer learning framework that employs heterogeneous graph neural networks (HGNN) and LLMs to detect Rust vulnerabilities without the need for Rust-specific training. TL-HGNN utilizes Inter-procedural Compressed Code Property Graphs (ICCPGs) to represent source code from high-resource languages (C or Java), training HGNN models that capture semantic and structural relationships. Rust code is translated into the source language using an iterative LLM-based approach to ensure correct syntax. The translated code is then converted into an ICCPG representation and analyzed with pre-trained HGNN models. Evaluations on 82 real-world Rust CVE pairs across 44 CWEs indicate that TL-HGNN achieves higher performance than the evaluated baselines on this dataset, achieving an F1 score of 66.24%. Additionally, an ablation study suggests the advantages of ICCPG representation over prior graph methods and the effectiveness of LLM translation over dictionary-based mapping for transfer learning. Our results also indicate that Java serves as a more effective source language than C in this context, and GPT-4.0 achieves higher performance than several other LLMs in translation quality. TL-HGNN represents an early application of transfer learning to Rust vulnerability detection.