# Go Source Code Vulnerability Detection Method Based on Graph Neural Network
## 1 Introduction  
Under the von Neumann architecture, software vulnerabilities are inevitable. As software scales grow larger and functional modules become increasingly complex, vulnerabilities continue to emerge. The rise of various open-source communities has also made code sharing more common. During code replication, developers may inadvertently introduce vulnerabilities, making code reuse a significant cause of software vulnerabilities [1]. According to the National Vulnerability Database (NVD), over 18,000 security vulnerabilities were disclosed in 2021, with more than 3000 classified as high-risk [2]. Conducting vulnerability detection on source code can help security professionals identify software vulnerabilities early and ensure system security. Deep learning-based vulnerability detection methods are generally categorized into sequence-based and graph-based approaches [3]. Sequence-based models are adept at learning code semantics, but they can only capture the surface structure of source code text, making it difficult to extract structural and semantic features of the source code [4]. As shown in [5], existing LSTM-based methods often suffer from poor accuracy. AlthoughGNN-based techniques can capture global structures and deep semantic information and are more effective than text-based approaches [6; 7], they still have three major issues:  
1. Different forms of code representation in these methods retain only partial information (syntax or semantics) [8], making it difficult to integrate the contextual semantic information of the original code [3]. 2. These methods often represent a function as a single graph, where each node corresponds to a statement, neglecting fine-grained information within the statements [4]. 3. Directly feeding raw source code, which contains a large amount of redundant code, into a graph neural network significantly increases the training time [9]. Additionally, while deep learning-based static analysis techniques have proven effective in detecting vulnerabilities in programming languages, especially mainstream ones like C/C++, Java, and PHP, relatively few studies have specifically focused on the unique characteristics of the Go language. Existing Go program detection methods, such as GCatch, GFix [10], and GFUZZ [11], primarily focus on detecting concurrency errors and overlook other types of vulnerabilities in Go programs, such as SQL injection, cross-site scripting (XSS), and insecure file uploads. To address these challenges, we propose GoVulDect, a hybrid semantic-based Go source code vulnerability detection model that comprehensively captures Go source code information for vulnerability detection. We use graph random walk networks [12] to extract deep semantic and structural information of each concurrent vulnerability in Go source code. Additionally, we introduce lexical analysis on top of taint analysis and leverage a Transformer model with a multi-head attention mechanism to learn the contextual semantic information of various types of vulnerabilities in Go source code. Finally, we concatenate information from both dimensions and use an XGBoost classifier [13] for classification and detection, minimizing feature omission and enabling the detection of various complex types of vulnerabilities in Go programs. To reduce time overhead, we employ program pruning techniques during preprocessing to extract essential code segments and adopt a synchronized feature extraction strategy. Overall, this paper makes the following contributions:  
(1) Go Program Pruning Method for Structural Integrity: We propose a Go program pruning method that ensures structural integrity. It pre-filters code lines closely related to Go vulnerabilities and retains original structural relationships using differential comparison techniques, enabling a more comprehensive extraction of vulnerability context information. (2) Hybrid Semantic-Based Graph Neural Network Vulnerability Detection Framework: We propose a hybrid semantic-based GNN Go source code vulnerability detection framework.