An Approach of Structure‐Enhanced Code‐Centric Graph Learning for Just‐in‐Time Software Vulnerability Detection

ABSTRACT In recent years, just‐in‐time vulnerability detection (JIT‐VD) has become an essential strategy for improving software security, as JIT‐VD can enable the immediate identification of vulnerable or flawed code‐commits at the moment they are introduced. Unlike traditional vulnerability detection approaches, which scan entire repositories as well as often producing delayed or excessive reports, JIT‐VD delivers timely alerts that allow developers to address security issues while the rationale behind their changes is still clear. This approach reduces remediation costs, prevents the propagation of vulnerabilities into production and aligns well with agile development practices. However, JIT‐VD remains challenging because it must capture complex dependencies between recent modifications and the existing codebase to correctly differentiate between safe and risky code‐commits. Recent studies have employed code transformation graphs (CTGs) to model the semantic relationships between consecutive commits, using graph neural networks (GNNs) to learn vulnerability patterns. Although CTG‐based techniques have achieved promising results, most existing models primarily preserve local structural information, thus neglecting the global structural context that reflects how changes affect the broader system. This oversight limits their ability to identify vulnerabilities caused by indirect or cross‐module interactions. To overcome these limitations, we propose SCGL, a structure‐enhanced code‐centric graph learning framework that integrates relation‐aware local modelling via RGCN with global structural representation learning using GIN. This dual‐view design allows our proposed SCGL model to capture both fine‐grained local relations as well as high‐level global dependencies within CTGs. By better leveraging these enriched representations, our SCGL model can significantly improve JIT‐VD predictions. Comprehensive experiments on benchmark datasets confirm that our SCGL model consistently surpasses state‐of‐the‐art methods, thus demonstrating the value of incorporating global context alongside local features in vulnerability detection.