# Go Source Code Vulnerability Detection Method Based on Graph Neural Network
## 5 Experiments and Results
### Experimental Setup and Evaluation Metrics  
**(1) Experimental Setup.** We conducted experiments using a machine equipped with an NVIDIA RTX 2080 TI GPU and an Intel(R) i9 CPU with 128 GB RAM. The complete experimental environment is detailed in Table 2.  
**(2) Model Hyperparameter Settings.** For neural networks, hyperparameter selection is critical as it directly impacts model performance, training speed, and generalization ability. Since hyperparameters are set before training and cannot be adjusted automatically, careful selection and tuning are necessary. Table 3 lists the hyperparameters used in our GraphSAGE model. To determine appropriate values, we performed a random search over the hyperparameter space and selected the configuration that yielded the best validation performance across multiple trials. In addition, XGBoost was used with its default parameters: 100 trees, a maximum depth of 6, a learning rate of 0.3, no early stopping, and a scale_pos_weight of 1.  
**(3) Evaluation Metrics.** We use four widely adopted evaluation metrics to comprehensively measure the vulnerability detection capability of our model:  
* \(Accuracy\) (\(A\)) = \(\frac{TP+TN}{TP+TN+FP+FN}\),
* \(Precision\) (\(P\)) = \(\frac{TP}{TP+FP}\),
* \(True\) Positive Rate (\(TPR\)) = \(\frac{TP}{TP+FN}\),
* \(F1\)_score (\(F1\)) = \(\frac{2\times P\times TPR}{P+TPR}\).  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**CWE-ID** & **Description** & **Number** \\ \hline CWE-79 & Improper neutralization of input during web page generation. & 67 \\  & (“Cross-Site Scripting”) & 45 \\  & & \\ CWE-22 & Improper limitation of a pathname to a restricted directory. & 45 \\  & (“Path Traversal”) & 45 \\ \hline CWE-400 & Uncontrolled resource consumption. & 39 \\ \hline CWE-20 & Improper input validation. & 35 \\ \hline CWE-287 & Improper authentication. & 24 \\ \hline CWE-284 & Improper access control. & 21 \\ \hline CWE-200 & Exposure of sensitive information to an unauthorized user. & 19 \\ \hline CWE-601 & URL redirection to an untrusted site. (“Open Redirect”) & 17 \\ \hline CWE-863 & Incorrect authorization. & 17 \\ \hline CWE-352 & Cross-Site Request Forgery. (CSRF) & 14 \\ \hline \hline \end{tabular}
\end{table}
Table 1: Top 10 CWE types by frequency in the dataset.  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Component** & **Configuration** \\ \hline Operating System & Ubuntu 18.04.1 \\ \hline Programming Language & Programming Language \\ \hline  & Pyg-lib == 0.3.1 + pt21 cu121 \\ Major Python Libraries & Torch == 2.0.1 + cu118 \\  & Scikit-learn == 1.3.2 \\  & Transformers == 4.35.2 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Experimental environment configuration details.  
These metrics are calculated using true positives (_TP_), false positives (_FP_), true negatives (_TN_), and false negatives (_FN_).  
To further assess classification performance, we also employ ROC curves and AUC values. Since AUC is insensitive to class distribution, it serves as a robust metric for evaluating model performance. An AUC score closer to 1 indicates better classification performance.