GraphEye: A Novel Solution for Detecting Vulnerable Functions Based on
  Graph Attention Network
  With the continuous extension of the Industrial Internet, cyber incidents
caused by software vulnerabilities have been increasing in recent years.
However, software vulnerabilities detection is still heavily relying on code
review done by experts, and how to automatedly detect software vulnerabilities
is an open problem so far. In this paper, we propose a novel solution named
GraphEye to identify whether a function of C/C++ code has vulnerabilities,
which can greatly alleviate the burden of code auditors. GraphEye is originated
from the observation that the code property graph of a non-vulnerable function
naturally differs from the code property graph of a vulnerable function with
the same functionality. Hence, detecting vulnerable functions is attributed to
the graph classification problem.GraphEye is comprised of VecCPG and GcGAT.
VecCPG is a vectorization for the code property graph, which is proposed to
characterize the key syntax and semantic features of the corresponding source
code. GcGAT is a deep learning model based on the graph attention graph, which
is proposed to solve the graph classification problem according to VecCPG.
Finally, GraphEye is verified by the SARD Stack-based Buffer Overflow,
Divide-Zero, Null Pointer Deference, Buffer Error, and Resource Error datasets,
the corresponding F1 scores are 95.6%, 95.6%,96.1%,92.6%, and 96.1%
respectively, which validate the effectiveness of the proposed solution.
