article · Information
Automated detection of software vulnerabilities frequently relies on Graph Neural Networks that overlook structural distinctions between syntax, control-flow, and data-flow connections. To resolve this limitation, a lightweight model named FastVulnGNN integrates edge-type information drawn from heterogeneous Code Property Graphs containing 33 node types and 21 edge types. The design couples an edge-conditioned message-passing system with a multi-scale readout mechanism combining mean, maximum, and learned attention pooling. Tested on a balanced dataset of 1,904 C and C++ code samples, the architecture achieves 71.1 percent accuracy, an F1 score of 0.70, and an AUC-ROC of 0.77 using only 71,810 parameters. Training completes in under two minutes on a single CPU core without requiring GPU hardware, demonstrating that compact, edge-aware networks can match the detection performance of considerably larger systems.
Software vulnerabilities represent a principal cause of security breaches, yet many advanced detection models require expensive, energy-intensive hardware. Demonstrating that compact, edge-aware models can achieve comparable accuracy on a standard computer processor lowers computational barriers, making automated security screening accessible on standard developer workstations and routine development workflows.
This technology is relevant to software development organisations and security tooling providers seeking automated vulnerability screening. As an applied and tested model evaluated on benchmark C and C++ code, it is suited for resource-constrained environments such as continuous-integration pipelines and developer workstations without dedicated graphics hardware. Moving towards practical commercial use would require integration into existing developer toolchains and validation across broader production codebases.
AI-generated from the published abstract. Always read the original work before citing.
Software vulnerabilities are a primary cause of security breaches, and their automated detection at scale has therefore become a pressing concern for both industry and academia. Most Graph Neural Network (GNN) approaches to vulnerability detection treat code graphs as homogeneous structures, and the semantic distinctions between Abstract Syntax Tree (AST) edges, Control-Flow Graph (CFG) edges, and data-flow dependency edges are consequently discarded. The main objective of this study is to determine whether explicitly conditioning message passing on edge type yields accurate yet lightweight detection. To this end, an edge-conditioned GNN named FastVulnGNN is proposed, in which the message-passing computation is conditioned on edge-type information drawn from Code Property Graphs (CPGs). FastVulnGNN operates on Joern-produced CPGs that contain 33 node types and 21 edge types, so that the full heterogeneous graph structure is preserved. A multi-scale readout mechanism that combines mean, maximum, and learned attention pooling is employed for graph-level classification, and the training configuration, which combines focal loss, label smoothing, and cosine annealing warm restarts, is individually validated by an ablation of the training objective. On the MegaVul dataset of 1904 balanced C/C++ samples, an accuracy of 71.1%, an F1 score of 0.70, and an AUC-ROC of 0.77 are achieved with only 71,810 parameters. Training completes in under two minutes on a single CPU core, and no GPU resources are required. The significance of this work lies in its demonstration that a compact, edge-aware architecture can match independently reproduced results of far larger models while remaining deployable in resource-constrained settings, such as continuous-integration pipelines and developer workstations. This study is deliberately framed as a controlled and reproducible engineering and evaluation contribution rather than as an architectural advance. An edge-type ablation study, a cross-dataset evaluation, and a per-vulnerability analysis are additionally reported to characterize the behavior and limitations of the model.
This page summarises published work. The authoritative version sits with the publisher.
DOI: 10.3390/info17080793
Is something wrong with this record? Report it or request removal.
Discussion
Have you built on this work, tried to replicate it, or seen it applied in practice? Share what you know. Verified researchers and MARATTO™ domain experts can open a discussion, and any member can reply. Contributions are reviewed before they appear.
No discussion yet. Open the first thread.
New to MARATTO™? Create a free account.
