article · Computers
Current deep-learning systems for detecting software vulnerabilities often struggle in operational settings due to large model sizes, high false-positive rates, opaque decisions, and a gap between benchmark results and practical utility. To address these issues, a hybrid framework combines a lightweight edge-conditioned graph neural network, named FastVulnGNN, with rule-based heuristics. The neural network contains 71,810 parameters and trains in 96.2 seconds on a single CPU core. It operates alongside rules targeting six C and C++ vulnerability classes: buffer overflows, format-string defects, null-pointer dereferences, double-free errors, integer overflows, and race conditions. On the MegaVul dataset, the neural model achieved an accuracy of 71.1 percent and an F1 score of 0.70. Evaluated on a production codebase of over 312,000 lines of code across 499 files, the hybrid system completed scanning in 5.5 seconds without GPU hardware, generating per-file risk tiers and pattern-level explanations.
Securing software codebases often forces teams to choose between slow, resource-heavy artificial intelligence models and rigid traditional scanners. Demonstrating that a compact neural network can scan code at tens of thousands of lines per second on standard processors makes automated security checks far more practical. It provides developers with rapid risk assessments and intelligible explanations directly within everyday software development workflows.
The framework appears applied and tested, having been validated on a production codebase without requiring specialised GPU infrastructure. It is aimed at software engineering teams and technology organisations seeking rapid vulnerability screening within continuous-integration pipelines. By scanning around 57,000 lines of code per second, the technology could be integrated into commercial developer toolchains to flag six critical C and C++ security flaws and deliver immediate, explainable risk assessments.
AI-generated from the published abstract. Always read the original work before citing.
The deployment of deep-learning vulnerability detectors in production remains difficult. Models are large, false-positive rates are high, output is opaque, and a persistent gap separates benchmark performance from real-world utility. The objective of this work is to close part of that gap by combining a learned detector with interpretable rules so that accuracy, efficiency, and actionability are achieved together. A hybrid framework is therefore presented in which a lightweight edge-conditioned GNN of 71,810 parameters, named FastVulnGNN, trained in 96.2 s on a single CPU core, is paired with rule-based heuristic detection for six C/C++ vulnerability classes, namely buffer overflows, format-string defects, null-pointer dereferences, double-free errors, integer overflows, and race conditions. On the MegaVul dataset, an accuracy of 71.1%, an F1 score of 0.70, and an AUC-ROC of 0.77 are obtained by the GNN component. On a production codebase of 499 files and 312,758 lines of code, the full hybrid scan completes in 5.5 s, which corresponds to about 57,000 lines per second, without any GPU hardware. Per-file risk tiers and pattern-level explanations are produced, and these are suitable for continuous-integration use. The significance of this work lies in demonstrating that a deployable, explainable detector can be assembled from compact components, and an edge-type ablation study, a cross-dataset evaluation, and a per-vulnerability analysis are reported to characterize the approach.
This page summarises published work. The authoritative version sits with the publisher.
DOI: 10.3390/computers15080542
Is something wrong with this record? Report it or request removal.
Discussion
Have you built on this work, tried to replicate it, or seen it applied in practice? Share what you know. Verified researchers and MARATTO™ domain experts can open a discussion, and any member can reply. Contributions are reviewed before they appear.
No discussion yet. Open the first thread.
New to MARATTO™? Create a free account.
