A Lightweight Hybrid Graph-Neural-Network and Heuristic Framework for Practical Software Vulnerability Assessment in Production Codebases

Abstract

The deployment of deep-learning vulnerability detectors in production remains difficult. Models are large, false-positive rates are high, output is opaque, and a persistent gap separates benchmark performance from real-world utility. The objective of this work is to close part of that gap by combining a learned detector with interpretable rules so that accuracy, efficiency, and actionability are achieved together. A hybrid framework is therefore presented in which a lightweight edge-conditioned GNN of 71,810 parameters, named FastVulnGNN, trained in 96.2 s on a single CPU core, is paired with rule-based heuristic detection for six C/C++ vulnerability classes, namely buffer overflows, format-string defects, null-pointer dereferences, double-free errors, integer overflows, and race conditions. On the MegaVul dataset, an accuracy of 71.1%, an F1 score of 0.70, and an AUC-ROC of 0.77 are obtained by the GNN component. On a production codebase of 499 files and 312,758 lines of code, the full hybrid scan completes in 5.5 s, which corresponds to about 57,000 lines per second, without any GPU hardware. Per-file risk tiers and pattern-level explanations are produced, and these are suitable for continuous-integration use. The significance of this work lies in demonstrating that a deployable, explainable detector can be assembled from compact components, and an edge-type ablation study, a cross-dataset evaluation, and a per-vulnerability analysis are reported to characterize the approach.