Vulnerability identification is crucial to protect software systems from attacks for cyber-security. However, huge projects have more than millions of lines of code, and the complex dependencies make it hard to carry out traditional static and dynamic methods. Furthermore, the semantic structure of various types of vulnerabilities differs greatly and may occur simultaneously, making general rule-based methods difficult to extend. In this paper, we propose \textit{Vignat}, a novel attention-based framework for identifying vulnerabilities by learning graph-level semantic representations of code. We represent codes with code property graphs (CPGs) in fine grain and use graph attention networks (GATs) for vulnerability detection. The results show that Vignat is able to achieve $57.38\%$ accuracy on reliable datasets derived from popular C libraries. Furthermore, the interpretability of our GATs provides valuable insights into vulnerability patterns.

翻译：摘要：漏洞识别对于保护软件系统免受网络攻击至关重要。然而，大型项目包含数百万行代码，复杂的依赖关系使得传统的静态和动态分析方法难以实施。此外，不同类型漏洞的语义结构差异显著且可能同时出现，导致基于通用规则的方法难以扩展。本文提出了一种新颖的基于注意力机制的框架Vignat，通过学习代码的图级语义表示来识别漏洞。我们以细粒度方式使用代码属性图（CPG）表示代码，并采用图注意力网络（GAT）进行漏洞检测。结果表明，Vignat在来自流行C语言库的可靠数据集上能够达到57.38%的准确率。此外，我们GAT的可解释性为理解漏洞模式提供了宝贵见解。