# Go Source Code Vulnerability Detection Method Based on Graph Neural Network
## 4 Methodology
### Graph-Level Feature Extraction  
(1) Code Representation. Vulnerabilities often arise from improper function calls and parameter references. Although normal and vulnerable code may differ by only a few lines, control flow and data flow dependencies reveal clear distinctions. To comprehensively extract these dependencies, we transform preprocessed Go source code into a code property graph (CPG). The code property graph (CPG) is a unified graph representation that integrates abstract syntax trees (ASTs), control flow graphs (CFGs), and data flow  
Figure 1: GoVulDect framework. (Module 1: Graph-Level Feature Extraction Module, which extracts graph-level features of potentially concurrent Go function slices. Module 2: Token-Level Feature Extraction Module, which extracts token-level features of slices using taint analysis. Module 3: Detection Module, which classifies and detects vulnerabilities in Go source code.) graphs (DFGs) to comprehensively model both syntactic and semantic aspects of programs. In a CPG, nodes represent key program entities such as functions, variables, operators, and control structures. Each node is enriched with type information, scope, and source code location. Edges capture relationships between these entities, including call edges, data flow dependencies, and control flow dependencies. First, we use Go's official standard packages \(go/parser\) and \(go/ast\) to parse the source code and generate the corresponding abstract syntax tree (AST). Then, we perform type checking and static semantic analysis on the AST using the \(go/types\) package to resolve the types of variables, functions, and expressions. Based on the type-annotated AST, we utilize the \(golang.org/x/tools/go/ssa\) package to convert the code into static single ssignment (SSA) intermediate representation. As the intermediate representation adopted by the Go compiler, SSA simplifies control and data flow analysis, enhances concurrency-related analysis, and significantly improves the compiler's optimization capabilities. The control flow graphs (CFGs) and data flow graphs (DFGs) constructed based on SSA are further used to model control and data dependencies within the program. Although the initial CPG representation contains static structural information, control flow, and data flow semantics, further optimization is necessary. We remove redundant nodes and prune unnecessary parts that do not affect analysis results. Figure 2 shows an optimized CPG example derived from the Go code in Figure 3.  
Finally, to convert Go programs into semantic vector representations suitable for neural network input, we employed a pretrained SpanBERT model to embed nodes in the source code, generating high-dimensional semantic vectors for each code fragment. In this study, we observed that most nodes had effective feature lengths no greater than 20 after vectorizing the nodes and edges in the graph. Therefore, to ensure both representational completeness and consistency in vector dimensions, we set the feature vector length to 20. A detailed introduction to SpanBERT is provided in the next section, while this section focuses on the GraphSAGE model. Figure 3: Sample Go code. Figure 2: Go program code property graph after preprocessing. (2) Graph-Level Feature Extraction. Treating code solely as text overlooks critical control dependencies and data dependencies. To extract deep semantic information more effectively from Go source code, we construct a detection model based on the GraphSAGE network, which employs random walk sampling on graphs. GraphSAGE is particularly well-suited for handling large-scale and complex projects because it learns node embeddings by iteratively sampling a fixed number of neighboring nodes rather than requiring access to every node during training. This makes it capable of efficiently learning from graphs of varying sizes and structures. Additionally, when aggregating features, GraphSAGE allows the model to select different aggregation functions based on specific tasks.