Cross-view subgraph learning for function-level vulnerability detection

Zhao Zhang

doi:10.1016/j.jss.2026.113078

Return

Cross-view subgraph learning for function-level vulnerability detection

2026-08-28

PRE

Zhao Zhang *

Senlin Luo

Limin Pan

DOI：10.1016/j.jss.2026.113078

Original

Original request for help

Save

Abstract

En 中文

Source code vulnerability detection plays a crucial role in ensuring software security, yet it remains challenging to preserve vulnerability-related dependencies and coordinate structural and semantic evidence. Existing graph-based methods usually encode code property graphs into function-level representations, where dependencies among key code components, such as condition checks, variable propagation, and sensitive operations, may be diluted by weakly relevant statements or branches. Meanwhile, structural and semantic representations may emphasize different evidence for the same function, leading to inconsistent vulnerability-discrimination tendencies and increasing the risk of misclassification. To address these issues, we propose SSCV-VD (Structural-Semantic Cross-View Vulnerability Detection), a cross-view subgraph learning framework for function-level vulnerability detection. To reduce dependency dilution, SSCV-VD constructs local subgraphs around candidate key nodes and weights them using function-level semantic context, thereby emphasizing vulnerability-related structural relations. To alleviate inconsistent predictions between structural and semantic views, SSCV-VD introduces a gated fusion mechanism to adaptively balance graph-based structural and sequence-level semantic representations for each function, and applies a cross-view consistency constraint to reduce their discrepancy in vulnerability-oriented discrimination. Experiments on multiple benchmark datasets show that SSCV-VD achieves the best F1 score under standard within-dataset evaluation settings.