GNN-Based Transfer Learning and Tuning for Detecting Code Vulnerabilities across Different Programming Languages

Machine learning has emerged as a promising method for detecting code vulnerabilities. In existing research, models trained on available samples are applied to predict potential vulnerabilities in new code within the same language. This approach may not be directly applicable when dealing with languages that have limited vulnerable samples available. This paper leverages transfer learning and k-shot tuning to address this issue, aiming to classify various Common Weakness Enumeration (CWE) categories in code written in a target language by utilizing a model trained on data from a different base language. We build upon a foundational model that enhances a state-of-the-art Graph Neural Network (GNN) framework designed for code vulnerability detection. Our experiments using extensive datasets of 42 common CWEs in C, Java, and C# have yielded valuable findings. Specifically, when models trained in one language are transferred to another, there is a noticeable improvement in detection performance. The magnitude of performance enhancements varies across different CWEs. k-shot tuning further refines the transferred models. However, the extent of performance gains gradually diminishes as the value of k increases. Once k exceeds a certain threshold, the transferred knowledge may be overwritten. Furthermore, our research unveiled an asymmetry in the two transfer learning directions within each language pair, even when the languages share the same programming paradigm. Transferred models in both directions often exhibit differing performance levels across the majority of CWEs.