# Go Source Code Vulnerability Detection Method Based on Graph Neural Network
## 6 Conclusions  
At present, relatively few deep learning-based detection models have been specifically designed for Go language vulnerability detection. Most existing Go vulnerability detection tools focus only on concurrency errors and do not address other types of vulnerabilities. Therefore, we propose GoVulDect, a fine-grained, hybrid semantic-based graph neural network system for Go source code vulnerability detection.  
First, we extract each function and generate slices, then represent them as code property graphs (CPGs) and use GraphSAGE to extract graph-level structural features. Although we strive to retain as much graph structure information as possible, some local and context-based semantic information loss is inevitable. To address this, we apply taint analysis to extract vulnerability slices and capture fine-grained token-level features. Finally, we use XGBoost to classify the fused features, enabling vulnerability detection. The fused  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Model/Tool** & **Training Time (s)** & **Detection Time (s)** \\ \hline RATS & / & 0.012 \\ CSGVD & 7589.810 & 62.063 \\ VDoTR & 17,822.211 & 79.180 \\ AMPLE & 5125.166 & 17.121 \\
**GoVulDect** & **4221.945** & **3.116** \\ \hline \hline \end{tabular}
\end{table}
Table 9: Performance comparison results of different models.  
features not only incorporate global control dependencies, data dependencies, and other semantic information of the source code but also preserve contextual semantics and local details of vulnerable code. Experiments on CVE vulnerability datasets demonstrate that GoVulDect achieves an F1-score of over 91%, significantly outperforming all existing vulnerability detection tools and models.  
For future work, we plan to address several important limitations and explore further improvements. (1) Enhancing semantic feature representation: The current token-level semantic extraction module has limited capacity in representing complex semantics. With the rapid advancement of large language models (LLMs), we aim to adopt more powerful pretrained models to improve semantic understanding and representation. (2) Improving feature fusion between graph and semantic views: At present, graph and token-level features are fused via simple concatenation, which may underutilize their complementary nature. We plan to explore more integrated fusion strategies, such as co-training frameworks inspired by GraphCodeBERT, to enable joint learning and deeper feature interaction. (3) Handling multi-label vulnerability attribution: In real-world scenarios, a single code segment may correspond to multiple CWE types. For example, a buffer overflow vulnerability may involve both missing boundary checks (CWE-119) and use-after-free issues (CWE-416). Our current model assumes single-label classification, which limits its applicability. We plan to incorporate multi-label classification techniques to better capture such complex cases.  
Conceptualization, L.Y.; methodology, L.Y.; software, L.Y.; validation, L.Y.; formal analysis, Y.F.; investigation, Q.Z.; resources, L.Y.; data curation, Y.F.; writing--original draft preparation, L.Y.; writing--review and editing, Y.F. and Y.X.; visualization, Q.Z.; supervision, Z.L.; project administration, Q.Z.; funding acquisition, Z.L. and Y.X. All authors have read and agreed to the published version of the manuscript.  
This research was funded by the Key Laboratory of Data Protection and Intelligent Management, Ministry of Education, Sichuan University (SCUSAACYD202401).  
The data used in this paper are collected through our own experiments and are not yet publicly available. However, data may be obtained from the authors upon reasonable request.  
The authors declare no conflicts of interest.