A PRISMA-informed structured topical review of 87 studies is presented and a strategic agenda covering leakage-resistant datasets, uncertainty-aware graph construction, repository-level evaluation, cost-effective Graph–LLM collaboration, and graph-guided autonomous vulnerability repair is developed.
Abstract
Software vulnerability mining is important for improving software reliability and security. Compared with sequence-based models, graph neural networks (GNNs) can explicitly model program structures such as syntax, control flow, data flow, call relations, and dependency paths, and have therefore been widely studied for vulnerability detection, localization, explanation, and repair. This paper presents a PRISMA-informed structured topical review of 87 studies and addresses five research questions concerning program graph representation, homogeneous and heterogeneous GNN architectures, Graph–LLM integration, evaluation reliability, and future research directions. The reviewed evidence shows that graph-based methods are most effective when vulnerability mechanisms can be faithfully represented through explicit structural relations. However, their reported performance remains strongly affected by duplicated samples, random function-level splits, noisy labels, incomplete repository context, graph-construction errors, and weak explanation protocols. Homogeneous GNNs provide efficient structural message passing but may mix different semantic relations, whereas heterogeneous GNNs preserve relation types more explicitly at the cost of greater graph-quality and computational requirements. Graph–LLM systems can improve semantic reasoning, repository-level analysis, explanation generation, and repair support, but their benefits should be evaluated together with memory consumption, inference latency, deployment complexity, and verification cost. This review further proposes minimum requirements for reliable vulnerability benchmarks and verifiable explanations, and develops a strategic agenda covering leakage-resistant datasets, uncertainty-aware graph construction, repository-level evaluation, cost-effective Graph–LLM collaboration, and graph-guided autonomous vulnerability repair.
Software vulnerabilities are a primary cause of security breaches, and their automated detection at scale has therefore become a pressing concern for both industry and academia. Most Graph Neural Network (GNN) approaches to vulnerability detection treat code graphs as homogeneous structures, and the semantic distinctions between Abstract Syntax Tree (AST) edges, Control-Flow Graph (CFG) edges, and data-flow dependency edges are consequently discarded. The main objective of this study is to determine whether explicitly conditioning message passing on edge type yields accurate yet lightweight detection. To this end, an edge-conditioned GNN named FastVulnGNN is proposed, in which the message-passing computation is conditioned on edge-type information drawn from Code Property Graphs (CPGs). FastVulnGNN operates on Joern-produced CPGs that contain 33 node types and 21 edge types, so that the full heterogeneous graph structure is preserved. A multi-scale readout mechanism that combines mean, maximum, and learned attention pooling is employed for graph-level classification, and the training configuration, which combines focal loss, label smoothing, and cosine annealing warm restarts, is individually validated by an ablation of the training objective. On the MegaVul dataset of 1904 balanced C/C++ samples, an accuracy of 71.1%, an F1 score of 0.70, and an AUC-ROC of 0.77 are achieved with only 71,810 parameters. Training completes in under two minutes on a single CPU core, and no GPU resources are required. The significance of this work lies in its demonstration that a compact, edge-aware architecture can match independently reproduced results of far larger models while remaining deployable in resource-constrained settings, such as continuous-integration pipelines and developer workstations. This study is deliberately framed as a controlled and reproducible engineering and evaluation contribution rather than as an architectural advance. An edge-type ablation study, a cross-dataset evaluation, and a per-vulnerability analysis are additionally reported to characterize the behavior and limitations of the model.
Ahmed M. Elalfy, G. Ebrahim, M. B. Mansour· Information· 0 citations
The open-source component-based development model has been widely adopted in software engineering. However, the complex correlations between open-source component dependency chains and vulnerabilities are difficult to effectively characterize, making it challenging to accurately identify vulnerabilities and quantify their impact scope. To address these issues, this paper proposes an open-source component vulnerability analysis method based on relational subgraph fusion. First, by parsing open-source component dependency configuration files, a knowledge graph containing components, versions, vulnerabilities, and their relationships is constructed, unifying the modeling of component dependencies and vulnerability information. Second, relational subgraphs centered on open-source components and vulnerabilities are constructed by relationship type. Graph Attention Networks (GAT) and multi-head attention mechanisms are employed to extract embedded representations of different subgraphs, and attention-weighted fusion achieves deep integration of multi-centered subgraph features, effectively distinguishing the heterogeneous impacts of different relationship types on central nodes. Finally, similarity matching is used to identify candidate triplets, and meta-path evaluation is combined to compute the scope of vulnerabilities' impact on open-source components. Experimental results demonstrate that the proposed method can effectively achieve comprehensive analysis of open-source components and vulnerabilities in the software supply chain.
Jing Zhou, Qiaojuan Jia, Tianqi Peng et al.· 2026 8th International Confe...· 0 citations
The LLM-Enhanced Component Dependency Evolution Graph (CDEG) framework is proposed, a hybrid representation that fuses structural features extracted by Tree-sitter with semantic embeddings derived from a fine-tuned LLM, effectively distinguishing backported patches from code refactoring.
Yuan-Jun Gao, Hong-Zhou Wu, Yu-Jia Luo et al.· Mathematics· 0 citations
Software vulnerabilities pose a severe threat to system security and stability. To reinforce the hierarchical structure of source code, enhance the distinctiveness of embedded features, and reduce feature confusion, we propose CADetect, a vulnerability detection model based on clustering-aware heterogeneous code graphs. First, a hierarchical clustering algorithm is applied to constrain and optimize the embedding vectors. This enhances the model’s ability to differentiate between diverse node and edge types within the heterogeneous code graphs, while streamlining code structures and reducing redundant information. Subsequently, multi-scale convolutions with varying kernel sizes are designed to extract vulnerability features at different granularities, effectively mitigating the information loss commonly caused by single-scale convolutions. Finally, extensive evaluations on the FFmpeg+Qemu, BigVul, and Reveal datasets demonstrate the effectiveness of the proposed model, and ablation studies confirm the specific contributions of the clustering algorithm and multi-scale convolutions.
With the in-depth advancement of hardware-software integration in smart cities and industrial systems, cybersecurity vulnerability threats have become increasingly severe. Graph Neural Network (GNN)-based vulnerability detection technologies have been widely adopted due to their efficient modeling capabilities for code semantics and structures. However, the “black-box” nature of their prediction process severely restricts their practical deployment. Existing general-purpose GNN explanation methods fail to consider the differential impacts of edge types in code graphs on vulnerability formation in vulnerability explanation scenarios, leading to disconnection from the requirements of vulnerability explanation. To address this issue, this paper proposes a vulnerability explanation method integrating learnable edge-type weights, denoted as GE4Vul. This method introduces learnable edge-type weights and L2 regularization constraints, and generates fine-grained explanations pointing to vulnerable code lines through weighted edge mask calculation and node importance ranking. Experiments on three real-world open-source project datasets (FFmpeg, ImageMagick, and radare2) demonstrate that GE4Vul achieves superior explanation accuracy compared to GNNExplainer and PGExplainer, providing targeted technical support for subsequent vulnerability cause analysis and remediation.
Yu Liu, Bin Liu, Shihai Wang et al.· International Conference on...· 0 citations
Software architectural drift arises when a software system’s implementation gradually diverges from its intended architectural design, leading to reduced maintainability, increased technical debt, and higher evolution costs. Traditional drift detection methods rely heavily on manual analysis, rule-based constraints, static metrics, or architectural conformance checking, all of which struggle to capture complex and evolving structural dependencies. This paper proposes a Graph Neural Network (GNN-based) predictive framework for modeling software architecture as heterogeneous dependency graphs and identifying potential drift before it manifests in code-level violations. The approach integrates structural features, semantic code embeddings, version-history evolution patterns, and architectural constraints into a unified graph learning model. Experimental evaluation on open-source and industrial projects demonstrates that the proposed GNN model outperforms conventional static analysis and machine learning baselines in predicting architectural deviations, detecting anomalous dependency formations, and flagging early indicators of structural degradation. The study contributes a scalable, learning-based methodology for proactive architectural governance and long-term software quality preservation.
S. Rahman· International Journal of Art...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
