Learning to Locate: GNN-Powered Vulnerability Path Discovery in Open Source Code

2025-07-23

AI Summary

Existing vulnerability detection methods struggle to explain root causes, particularly exhibiting poor generalization in identifying vulnerable statements and triggering execution paths. To address this, we propose VulPathFinder—a novel framework that, for the first time, employs Graph Neural Networks (GNNs) to automatically identify vulnerability sinks (replacing rule-based matching), integrated with semantics-aware program slicing and path-ranking mechanisms for end-to-end vulnerability path localization and root-cause attribution. VulPathFinder models both syntactic and semantic code dependencies via GNNs to precisely extract Potential Sink Points (PSPs), then efficiently extracts and ranks executable paths capable of triggering vulnerabilities. Evaluated on the SARD buffer overflow dataset, VulPathFinder significantly outperforms SliceLocator and GNNExplainer in path discovery accuracy and interpretability, thereby enhancing the automation and generalizability of root-cause analysis for software vulnerabilities.

Technology Category

• Natural Language Processing: Code Generation / Program Synthesis from Natural Language
• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Graph-based Machine Learning

Application Category

• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs
• Search and Retrieval-Augmented AI: Web query analysis, representation and understanding

Abstract

Detecting security vulnerabilities in open-source software is a critical task that is highly regarded in the related research communities. Several approaches have been proposed in the literature for detecting vulnerable codes and identifying the classes of vulnerabilities. However, there is still room to work in explaining the root causes of detected vulnerabilities through locating vulnerable statements and the discovery of paths leading to the activation of the vulnerability. While frameworks like SliceLocator offer explanations by identifying vulnerable paths, they rely on rule-based sink identification that limits their generalization. In this paper, we introduce VulPathFinder, an explainable vulnerability path discovery framework that enhances SliceLocator's methodology by utilizing a novel Graph Neural Network (GNN) model for detecting sink statements, rather than relying on predefined rules. The proposed GNN captures semantic and syntactic dependencies to find potential sink points (PSPs), which are candidate statements where vulnerable paths end. After detecting PSPs, program slicing can be used to extract potentially vulnerable paths, which are then ranked by feeding them back into the target graph-based detector. Ultimately, the most probable path is returned, explaining the root cause of the detected vulnerability. We demonstrated the effectiveness of the proposed approach by performing evaluations on a benchmark of the buffer overflow CWEs from the SARD dataset, providing explanations for the corresponding detected vulnerabilities. The results show that VulPathFinder outperforms both original SliceLocator and GNNExplainer (as a general GNN explainability tool) in discovery of vulnerability paths to identified PSPs.

Problem

• Detect root causes of vulnerabilities in open-source code
• Improve generalization of vulnerability path discovery
• Enhance accuracy in locating vulnerable statements and paths

Innovation

• GNN model detects sink statements
• Captures semantic and syntactic dependencies
• Ranks paths using graph-based detector