{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/devign-effective-vulnerability-identification","title":"Devign: Effective Vulnerability Identification by Learning Comprehensive Program Semantics via Graph Neural Networks","arxiv_id":"1909.03496","date":"2019-09-08","proceeding":"NeurIPS 2019 12","authors":["Yaqin Zhou","Shangqing Liu","JingKai Siow","Xiaoning Du","Yang Liu"],"abstract":"Vulnerability identification is crucial to protect the software systems from attacks for cyber security. It is especially important to localize the vulnerable functions among the source code to facilitate the fix. However, it is a challenging and tedious process, and also requires specialized security expertise. Inspired by the work on manually-defined patterns of vulnerabilities from various code representation graphs and the recent advance on graph neural networks, we propose Devign, a general graph neural network based model for graph-level classification through learning on a rich set of code semantic representations. It includes a novel Conv module to efficiently extract useful features in the learned rich node representations for graph-level classification. The model is trained over manually labeled datasets built on 4 diversified large-scale open-source C projects that incorporate high complexity and variety of real source code instead of synthesis code used in previous works. The results of the extensive evaluation on the datasets demonstrate that Devign outperforms the state of the arts significantly with an average of 10.51% higher accuracy and 8.68\\% F1 score, increases averagely 4.66% accuracy and 6.37% F1 by the Conv module.","url_abs":"https://arxiv.org/abs/1909.03496v1","url_pdf":"https://arxiv.org/pdf/1909.03496v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"devign-effective-vulnerability-identification","repo_url":"https://github.com/epicosy/devign","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":null},{"paper_slug":"devign-effective-vulnerability-identification","repo_url":"https://github.com/saikat107/Devign","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"classification","task_name":"General Classification"},{"task_slug":"graph-neural-network","task_name":"Graph Neural Network"}],"methods":[{"method_slug":"graph-neural-network","method_name":"Graph Neural Network"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=1909.03496","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"1909.03496"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/saikat107/Devign","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/epicosy/devign","reach":null}],"summary":{"ran_draft_wrong":1,"unverified":6},"by_repo_kind":{"listed":{"samples":7,"ran":1,"repositories":2}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"a3a01919b1db43eb","entry":"graph_indexing","repo":"epicosy/devign","repo_kind":"listed","path":"src/prepare/cpg_generator.py","file_url":"https://github.com/epicosy/devign/blob/HEAD/src/prepare/cpg_generator.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"a3a01919b1db43eb"}},{"code_sha256_prefix":"0422695bfb48e57f","entry":"evaluate_loss","repo":"saikat107/Devign","repo_kind":"listed","path":"trainer.py","file_url":"https://github.com/saikat107/Devign/blob/HEAD/trainer.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"0422695bfb48e57f"}},{"code_sha256_prefix":"7930b76c6c087f9f","entry":"evaluate_metrics","repo":"saikat107/Devign","repo_kind":"listed","path":"trainer.py","file_url":"https://github.com/saikat107/Devign/blob/HEAD/trainer.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"7930b76c6c087f9f"}},{"code_sha256_prefix":"d51f0d19c0d96758","entry":"funcs_to_graphs","repo":"epicosy/devign","repo_kind":"listed","path":"src/prepare/cpg_generator.py","file_url":"https://github.com/epicosy/devign/blob/HEAD/src/prepare/cpg_generator.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d51f0d19c0d96758"}},{"code_sha256_prefix":"e27b3bbdae6eca62","entry":"initialize_batch","repo":"saikat107/Devign","repo_kind":"listed","path":"utils.py","file_url":"https://github.com/saikat107/Devign/blob/HEAD/utils.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"e27b3bbdae6eca62"}},{"code_sha256_prefix":"b0ca691a6d4e7496","entry":"joern_parse","repo":"epicosy/devign","repo_kind":"listed","path":"src/prepare/cpg_generator.py","file_url":"https://github.com/epicosy/devign/blob/HEAD/src/prepare/cpg_generator.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"b0ca691a6d4e7496"}},{"code_sha256_prefix":"5427b39c21c3a6b1","entry":"tally_param","repo":"saikat107/Devign","repo_kind":"listed","path":"utils.py","file_url":"https://github.com/saikat107/Devign/blob/HEAD/utils.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"5427b39c21c3a6b1"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}