# VulEye: A Novel Graph Neural Network Vulnerability Detection Approach for PHP Application
## 5 Evaluation
### Experimental Setups  
**Pretreatment. ** The source programs collected by SARD are marked with the corresponding CWE ID at the statement level into three labels, safe, unsafe, and mixed. \"Safe\" denotes the sample does not include security defects. \"Unsafe\" means the example contains one or more specific security defects. \"Mixed\" means the sample consists of security defects and their fixed security patches. We mark the pieces without security defects as 0 and those with one or more specific security defects as 1. The vulnerability detection model in this paper is conducted at the slice level, not at the method or file level, to report whether SDG slices have vulnerabilities. As described in Section 4.2, we first slice each source program and generate one or more SDG slices according to the number of sensitive functions that different programs may contain. Then, according to the above marking rules, we further mark whether the slice has vulnerable code lines as safe or unsafe. The specific process is as follows: If the sample is extracted from an \"unsafe\" or \"mixed\" program and it contains a vulnerable statement marked by SARD, we mark it as \"1\" (that is unsafe). Otherwise, it is marked as \"0\" (that is safe). Table 4 shows the statistics of SDG-sliced datasets. In the table, \"\(N\) denotes the statistics of SDG nodes, and \"\(E\) denotes SDG edges' statistics. \begin{table}
\begin{tabular}{c c c c c c c c c c c} \hline  & **Safe** & **Unsafe** & **Total** & **Total\_N** & **Max\_N** & **Avg\_N** & **Min\_N** & **Total\_E** & **Max\_E** & **Avg\_E** & **Min\_E** \\ \hline CWE-78 & 3204 & 888 & 4092 & 30,060 & 19 & 7.3 & 2 & 47,292 & 33 & 11.6 & 1 \\ \hline CWE-79 & 4358 & 1984 & 6342 & 43,474 & 18 & 6.9 & 2 & 65,940 & 31 & 10.4 & 1 \\ \hline CWE-89 & 13,797 & 1320 & 15,117 & 172,596 & 23 & 11.4 & 2 & 272,106 & 40 & 18 & 1 \\ \hline CWE-90 & 4464 & 2112 & 6576 & 51840 & 19 & 7.9 & 2 & 83,136 & 33 & 12.6 & 1 \\ \hline CWE-91 & 9833 & 2386 & 12,219 & 79,211 & 21 & 8.1 & 2 & 127,549 & 37 & 12.9 & 1 \\ \hline CWE-95 & 870 & 144 & 1014 & 8034 & 19 & 7.9 & 2 & 12,744 & 33 & 12.6 & 1 \\ \hline CWE-98 & 2028 & 1078 & 3106 & 14,388 & 18 & 7.1 & 2 & 22,128 & 31 & 10.9 & 1 \\ \hline CWE-601 & 3806 & 4078 & 7884 & 51,012 & 18 & 6.5 & 2 & 77,316 & 31 & 9.8 & 1 \\ \hline CWE-862 & 766 & 64 & 830 & 6436 & 21 & 7.8 & 3 & 10,343 & 37 & 12.5 & 2 \\ \hline Total & 43,126 & 10,590 & 53,716 & 457,051 & / & / & / & 718,554 & / & / & / \\ \hline \end{tabular}
\end{table} 
Table 4: Preprocessed Dataset. \begin{table}
\begin{tabular}{c c c c} \hline
**CWE** & **Safe** & **Unsafe** & **Total** \\ \hline OS Command Injection (CWE-78) & 1872 & 624 & 2496 \\ \hline Cross-site Scripting (CWE-79) & 5728 & 4352 & 10,080 \\ \hline SQL Injection (CWE-89) & 8640 & 912 & 9552 \\ \hline LDAP Injection (CWE-90) & 1728 & 2112 & 3840 \\ \hline XML Injection (CWE-91) & 4784 & 1264 & 6048 \\ \hline Eval Injection (CWE-95) & 1296 & 336 & 1632 \\ \hline PHP Remote File Inclusion (CWE-98) & 2592 & 672 & 3264 \\ \hline Open Redirect (CWE-601) & 2208 & 2592 & 4800 \\ \hline Missing Authorization (CWE-862) & 400 & 80 & 480 \\ \hline Totals & 29,248 & 12,944 & 42,192 \\ \hline \end{tabular}
\end{table} 
Table 3: Original Dataset  
**Configuration. ** We carried out all experiments in this paper on a high-performance host with 24-core CPU, 128G memory, and two NVIDIA RTX3090 graphics cards (only one in actual training). The detailed software and hardware configuration parameters are in Table 5. In the experiment, we use _Cross-Entropy_ as our loss function, because this is a multi-class classification problem. We set the model Dropout Rate to 0.5 and Learning Rate to 0.002 to prevent over-fitting during training. Through experimental comparison, we finally chose _Adam_ as the optimizer to accelerate the convergence of the network. The training process uses a batch size of 64. We randomized the data set, and the ratio of the training set, verification set, and test set is 8:1:1. **Criteria.