# Learning to map source code to software vulnerability using code-as-a-graph

arXiv: https://arxiv.org/abs/2006.08614 · HTML: https://mlsanity.com/paper/2006.08614/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 15 Jun 2020.

## Built on by (most cited first, 9 of 9)

- [D2A: A Dataset Built for AI-Based Vulnerability Detection Methods Using Differential Analysis](https://mlsanity.com/paper/2102.07995/) (2021)
- [Combining Graph Neural Networks with Expert Knowledge for Smart Contract Vulnerability Detection](https://mlsanity.com/paper/2107.11598/) (2021)
- [VELVET: a noVel Ensemble Learning approach to automatically locate VulnErable sTatements](https://mlsanity.com/paper/2112.10893/) (2021)
- [Use of Graph Neural Networks in Aiding Defensive Cyber Operations](https://mlsanity.com/paper/2401.05680/) (2024)
- [A Survey of Source Code Representations for Machine Learning-Based Cybersecurity Tasks](https://mlsanity.com/paper/2403.10646/) (2024)
- [A Unified Active Learning Framework for Annotating Graph Data with Application to Software Source Code Performance Prediction](https://mlsanity.com/paper/2304.13032/) (2023)
- [Code2Image: Intelligent Code Analysis by Computer Vision Techniques and Application to Vulnerability Prediction](https://mlsanity.com/paper/2105.03131/) (2021)
- [Data-Driven AI Model Signal-Awareness Enhancement and Introspection](https://mlsanity.com/paper/2111.05827/) (2021)
- [ActiveClean: Generating Line-Level Vulnerability Data via Active Learning](https://mlsanity.com/paper/2312.01588/) (2023)

## Abstract (arXiv)

We explore the applicability of Graph Neural Networks in learning the nuances of source code from a security perspective. Specifically, whether signatures of vulnerabilities in source code can be learned from its graph representation, in terms of relationships between nodes and edges. We create a pipeline we call AI4VA, which first encodes a sample source code into a Code Property Graph. The extracted graph is then vectorized in a manner which preserves its semantic information. A Gated Graph Neural Network is then trained using several such graphs to automatically extract templates differentiating the graph of a vulnerable sample from a healthy one. Our model outperforms static analyzers, classic machine learning, as well as CNN and RNN-based deep learning models on two of the three datasets we experiment with. We thus show that a code-as-graph encoding is more meaningful for vulnerability detection than existing code-as-photo and linear sequence encoding approaches. (Submitted Oct 2019, Paper #28, ICST)