CSCVD: A Method of Source Code Vulnerability Detection Based on Semantic Feature and Context Dependence

Most current source code vulnerability detection methods use the single sequence or graph representation, which cannot effectively extract multi-dimensional code features. To solve this problem, we propose a novel vulnerability detection method CSCVD (Combining Semantic feature and Context dependency for Vulnerability Detection) based on semantic features and context dependency. Firstly, we utilize the CB-BL model to serialize and embed code statement segments to extract local semantic features, and the source code is analyzed by data flow and control flow to construct control flow diagram, as well as the local semantic features are embedded into the control flow diagram as nodes. Then the graph attention network is used to extract the information of different types of edges in the control flow graph to capture the code context dependencies. Finally, the multi-dimensional features are fused to obtain more abundant vulnerability features, and the vulnerability probability is calculated using multi-layer perceptron to complete the source code vulnerability detection task. The experimental results show that CSCVD improves the performance of vulnerability detection compared with static analysis tool Flwafinder, program-slic-based detection method VulDeepecker and graph neural network-based detection method. Specifically, CSCVD obtains 63.59% accuracy and 65.91% recall on the real-world benchmark dataset from CodeXGLUE for vulnerability detection.