# Go Source Code Vulnerability Detection Method Based on Graph Neural Network
## 2 Related Work  
### Go Program Vulnerability Detection  
As a mainstream programming language, memory corruption attacks targeting C/C++ have become a major threat to computer systems. The recently developed Go programming language is designed to prevent such attacks through its robust static type system, appropriate compiler optimizations, and runtime boundary checks [17]. In fact, Go is considered one of the best languages for developing secure systems [18] and has been progressively deployed in many popular applications and codebases. While Go prevents memory corruption and includes garbage collection to provide temporary security, it is still prone to vulnerabilities when interacting with other languages. For instance, when Go interacts with C's memory management, it may introduce use-after-gc errors and more complex double free errors. Additionally, Go is vulnerable to a new type of supply chain attack targeting source code, known as the Trojan Source attack [1].  
To address Go program vulnerabilities, researchers have been continuously improving Go source code vulnerability detection methods to enhance program security. Traditional source code vulnerability detection approaches can be categorized into rule-based program analysis [19] and pattern-based machine learning [20]. (1) Rule-based methods are inspired by traditional error detection techniques [21]. (2) Pattern-based methods employ conventional machine learning techniques to automatically learn vulnerability patterns from previously collected training samples [8].  
However, both approaches heavily rely on the expertise of developers and security professionals, often resulting in high false-positive and false-negative rates. Additionally, they struggle to detect unknown vulnerabilities and require extensive manual verification [14]. Traditional Go vulnerability detection methods primarily depend on manual review and automated static analysis tools. However, these approaches typically demand substantial human effort and time while being limited to detecting concurrency-related errors, making it difficult to identify complex and subtle vulnerabilities. In fact, an analysis of the dataset we collected shows that about 98.25% of Go vulnerabilities are not related to concurrency, underscoring the need for more comprehensive detection approaches.  
Deep learning (DL) has recently been introduced into the field of vulnerability detection due to its ability to process large amounts of software code and vulnerability data [22; 23; 24; 25]. DL models automatically capture the structural representation of programs from training samples and use this information for detection [26; 27]. In vulnerability detection, deep learning-based approaches can be divided into two main categories: (1) Sequence-based methods [23; 26; 27]: These approaches represent source code or its structural features as lexical token sequences [28] and apply natural language processing (NLP) techniques [26] to detect vulnerabilities by learning sequential features. (2) Graph-based methods [5; 22; 25; 29]: These approaches transform source code into heterogeneous graph structures and utilize graph neural networks (GNNs) to capture local structures and dependencies [24].  
In recent years, deep learning-based vulnerability detection techniques have made some progress, but relatively few models have been specifically designed for Go programs. We propose representing Go source code as graphs (e.g., abstract syntax trees (ASTs), control flow graphs (CFGs), etc.) and analyzing them using GNNs to extract Go program features for vulnerability detection. However, solely using GNN-based models has drawbacks--it can capture global structures and deep semantic information but often fails to retain contextual information.