# Go Source Code Vulnerability Detection Method Based on Graph Neural Network
## 5 Experiments and Results
### Results and Analysis
The results indicate that GoVulDect-Graph achieves a precision of 90.58%, slightly outperforming GoVulDect-Tokens (88.78%). However, the full GoVulDect model, which integrates both graph and token-level features, achieves a significantly higher precision of \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Model** & **Precision** & **Recall** & **F1-Score** \\ \hline GoVulDect-Graph & 0.9058 & 0.9039 & 0.9043 \\ GoVulDect-Tokens & 0.8878 & 0.8857 & 0.8859 \\
**GoVulDect** & **0.9477** & **0.9513** & **0.9489** \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Comparison of ablation experiment results. Figure 9: Scatter plot comparison of fused features. (Yellow and purple represent different vulnerability features, respectively.) 94.77%. This demonstrates that feature fusion effectively improves vulnerability detection, as it captures both structural information and contextual semantics of vulnerable code. **(3) Comparative Experiments. ** The code property graph (CPG) integrates multiple semantic representations, making it a powerful method for representing source code. To verify the advantage of CPG in vulnerability detection, we compared the ROC curves of the GraphSAGE model when applied to different code representations, as shown in Figure 10.  
The results indicate that the CPG-based model achieves the highest AUC score of 0.984, demonstrating that CPG captures a more comprehensive and rich set of graph structural features. Additionally, we observe that the AUC scores of the control flow graph (CFG) and control dependence graph (CDG) are lower than those of the data dependence graph (DDG). This suggests that data flow plays a more significant role in vulnerability detection compared to control flow. To achieve optimal classification performance, we compared several widely used classification models, including traditional machine learning algorithms (e.g., k-nearest neighbors (KNN), support vector machine (SVM), random forest (RF)), neural network-based models (e.g., multi-layer cerebrom (MLP), bi-directional LSTM), and ensemble learning methods such as XGBoost. These classifiers were selected to represent a diverse set of learning paradigms and are commonly used in software vulnerability detection tasks as baseline models. Although some classifiers such as KNN and SVM may be considered less advanced in modern deep learning research, we include them to ensure a complete and comprehensive evaluation of the effectiveness of our proposed graph-based feature representation. It is worth noting that SVM, especially when using the RBF kernel, suffers from scalability issues due to its quadratic complexity with respect to the number of training samples [45]. In our study, SVM is used solely as a baseline model for comparison purposes. For practical deployment and large-scale performance, more scalable classifiers such as XGBoost and BiLSTM are preferred. As shown in Table 6, XGBoost achieves the highest performance across all evaluation metrics, with an accuracy exceeding 94%. This demonstrates that XGBoost provides the most effective classification results in our vulnerability detection task. Furthermore, the consistently strong performance of our model across different classifiers also confirms the robustness and general applicability of the learned graph features. Figure 10: Different code representation comparison experiment. (**(left)** displays the ROC curves of GraphSAGE under several different code representations, while in the (right), the blue bar represents the CFG, the orange bar represents the CPG, and the green bar represents the DFG.) To comprehensively evaluate GoVulDect's vulnerability detection performance, we compared it with one commonly used detection tool and three state-of-the-art detection models. The results are summarized in Tables 7 and 8. We observe the following key findings: **(1) RATS**, a multi-language static vulnerability analysis tool, achieves the lowest performance across all metrics.