Efficient Software Vulnerability Detection Using Edge-Conditioned Graph Neural Networks on Heterogeneous Code Property Graphs
TL;DR
The significance of this work lies in its demonstration that a compact, edge-aware architecture can match independently reproduced results of far larger models while remaining deployable in resource-constrained settings, such as continuous-integration pipelines and developer workstations.
Abstract
Software vulnerabilities are a primary cause of security breaches, and their automated detection at scale has therefore become a pressing concern for both industry and academia. Most Graph Neural Network (GNN) approaches to vulnerability detection treat code graphs as homogeneous structures, and the semantic distinctions between Abstract Syntax Tree (AST) edges, Control-Flow Graph (CFG) edges, and data-flow dependency edges are consequently discarded. The main objective of this study is to determine whether explicitly conditioning message passing on edge type yields accurate yet lightweight detection. To this end, an edge-conditioned GNN named FastVulnGNN is proposed, in which the message-passing computation is conditioned on edge-type information drawn from Code Property Graphs (CPGs). FastVulnGNN operates on Joern-produced CPGs that contain 33 node types and 21 edge types, so that the full heterogeneous graph structure is preserved. A multi-scale readout mechanism that combines mean, maximum, and learned attention pooling is employed for graph-level classification, and the training configuration, which combines focal loss, label smoothing, and cosine annealing warm restarts, is individually validated by an ablation of the training objective. On the MegaVul dataset of 1904 balanced C/C++ samples, an accuracy of 71.1%, an F1 score of 0.70, and an AUC-ROC of 0.77 are achieved with only 71,810 parameters. Training completes in under two minutes on a single CPU core, and no GPU resources are required. The significance of this work lies in its demonstration that a compact, edge-aware architecture can match independently reproduced results of far larger models while remaining deployable in resource-constrained settings, such as continuous-integration pipelines and developer workstations. This study is deliberately framed as a controlled and reproducible engineering and evaluation contribution rather than as an architectural advance. An edge-type ablation study, a cross-dataset evaluation, and a per-vulnerability analysis are additionally reported to characterize the behavior and limitations of the model.