Code Graph Neural Network Fused with Pretrained Code Embeddings and Line Highlighting

About the code vulnerability detection M.Tech project

A single unchecked buffer or a missing bounds check in C code can open a door for attackers. Manual review is slow and rule-based scanners raise many false warnings. This code vulnerability detection M.Tech project studies a sharper question: if a model reads both the structure of a function and the meaning of its identifiers and API calls, does it find vulnerable functions more reliably, and can it point to the lines that caused the alarm?

Research behind it

Base paper. Tensor-based gated graph neural network for automatic vulnerability detection in source code, Software Testing, Verification and Reliability, Wiley, 2023. It treats code as several graphs with node features and joins them in a tensor-based gated graph neural network (TensorGNN) that gives function-level embeddings, evaluated on seven C and C++ corpora with 13 vulnerability types.

Research gap. Node features come from simple token embeddings, so the knowledge of pretrained code language models is not used. The output is a function-level label with no hint of where the problem lies. The rare vulnerable class gets no dedicated loss.

Proposed system and novelty. Each function is parsed into a code property graph with syntax, control flow and data flow edges. Node features come from a small pretrained code encoder instead of random embeddings. A gated GNN reads the graph while a second branch reads the whole-function embedding, and an attention gate learns how much to trust each branch. Node scores are mapped back to source lines, and focal loss is compared with balanced sampling.

Models compared. TF-IDF with Logistic Regression and Random Forest, a BiLSTM on tokens, a fine-tuned text-only code model and the base TensorGNN rebuilt on Devign. The ablation tests graph only, text only and fused, syntax edges against all edges, random against pretrained node features, and cross-entropy against focal loss.

A related security topic with a very different input is the prompt injection and jailbreak detection project for LLM apps.

How it works

• C functions from the Devign benchmark are parsed once and their graphs are cached.
• Each node gets an embedding from the pretrained code encoder.
• The graph branch and the function branch are fused by the attention gate.
• The model returns a risk score and the vulnerable or safe label.
• Node scores are traced back to lines and shown as a colour scale.

Users and modules

The developer pastes or uploads C code, reads the verdict and risk score, studies the highlighted lines and graph preview, and keeps a history of scans with PDF reports. The admin manages users, uploads model versions, tunes the risk threshold and views scan statistics and the experiment page. Graph building and inference run on a CPU laptop; fine-tuning the code encoder and full GNN training are done once on a free cloud GPU notebook.

What you get

• Phase 1 Research: Literature survey of 15-20 learning-based vulnerability papers; Base paper (Wiley STVR, 2023) with research gap and novelty; Devign data study with function and label EDA; Problem statement and objectives; Synopsis and Phase-1 report.
• Phase 2 Implementation: Flask web app with developer and admin panels; Code property graph builder with cached graphs; Pretrained code embeddings as node features; Baselines: TF-IDF models, BiLSTM, text-only code model, base TensorGNN; Proposed gated GNN and embedding fusion with line highlighting; MySQL database and trained models.
• Results: Accuracy, precision, recall, F1 and AUC; Top-k line hit rate on a hand-checked sample; Ablation: branches, edge types, node features, loss; Imbalance study: focal loss vs balanced sampling; results.xlsx and all graphs in high resolution.
• Thesis and paper: Thesis written for you (about 90 pages); IEEE conference paper draft; Journal paper draft; Publication guide.
• Reviews, viva and support: PPTs for Review 1, Review 2 and final viva; Viva book with 50+ questions; A1 poster and project diary; Demo and code walkthrough videos; 1-on-1 setup, 2 revisions and support till viva.

Who can use this project

It suits M.Tech and M.E. students of CSE and IT who want a software security dissertation built on graph learning. It also covers searches for code vulnerability detection using deep learning, a gated graph neural network project or a CodeBERT vulnerability detection project.