# Go Source Code Vulnerability Detection Method Based on Graph Neural Network
## 5 Experiments and Results
### Results and Analysis  
**(1) Model Classification Performance. ** To comprehensively evaluate the classification performance and generalization ability of the GoVulDect model, we analyzed the trends of training loss and validation accuracy during the training and validation phases, as shown in Figure 7. The training loss continuously decreased and stabilized around 0.1 after approximately 500 steps, indicating convergence. Meanwhile, the validation accuracy steadily increased and eventually plateaued at around 95%, without any noticeable fluctuation or decline. The close alignment between the training loss and validation accuracy suggests that the model effectively converged without signs of overfitting, demonstrating strong stability and generalization performance. Figure 7: Loss and accuracy curves during training and validation. (The green curve represents the training loss of the model as the number of training epochs increases, while the red curve represents the model’s validation accuracy.) \begin{table}
\begin{tabular}{c c c} \hline \hline
**Parameter** & **Description** & **Value** \\ \hline num\_samples & Neighbor sampling size & 25 \\ \hline aggregator\_type & Aggregation function & mean \\ \hline embedding\_size & Node embedding size & 64 \\ \hline num\_layers & Number of graph convolution layers & 2 \\ \hline l2\_reg & L2 regularization strength & 0.0001 \\ \hline learning\_rate & Learning rate & 0.01 \\ \hline dropout & Dropout rate & 0.3 \\ \hline epochs & Training epochs & 500 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: GraphSAGE model hyperparameters. To further assess the binary classification capability of the model, we tested it across various sample categories. As presented in Table 4, the GoVulDect model achieves precision, recall, and F1-scores above 94% for both benign and vulnerable samples, with an overall accuracy of 95%. These results indicate that the model demonstrates strong classification performance and is capable of effectively distinguishing between vulnerable and non-vulnerable code. Moreover, the close values of the \"Macro AVG\" and \"Weighted AVG\" metrics suggest that the model performs consistently across classes, without exhibiting significant bias toward any particular category. To verify whether the model can accurately identify different types of vulnerabilities, we generate a multi-class confusion matrix, as shown in Figure 8. Notably, the model achieves a detection accuracy of over 81% for CWE-79 and CWE-200, demonstrating that GoVulDect exhibits strong classification capability and high accuracy when handling various types of vulnerabilities. **(2) Effectiveness of Feature Fusion. ** To validate the effectiveness of our feature fusion approach, we visualized the distribution of token-level features (bottom), graph-level features (middle), and their fused features (top) in both 2D (left) and 3D (right) spaces, as il \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Class** & **Precision** & **Recall** & **F1-Score** & **Sample Size** \\ \hline Benign Samples & **0.96** & 0.94 & 0.95 & 1646 \\ \hline Vulnerable Samples & 0.94 & **0.96** & 0.95 & 1604 \\ \hline Accuracy & / & / & 0.95 & 3250 \\ \hline Macro AVG & 0.95 & 0.95 & 0.95 & 3250 \\ \hline Weighted AVG & 0.95 & 0.95 & 0.95 & 3250 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Classification report of GoVulDect. Figure 8: The confusion matrix of the model’s classification results for multiple types of data. (The darker the color, the higher the model’s accuracy in distinguishing vulnerabilities.) lustrated in Figure 9. The results clearly show that the fused features (top) exhibit the best separability, indicating that feature fusion significantly improves the model's performance. To further confirm the effectiveness of feature fusion, we conducted an ablation study, comparing models using only graph-level features (GoVulDect-Graph), only token-level features (GoVulDect-Tokens), and our full GoVulDect model. Table 5 presents the results.