# VulEye: A Novel Graph Neural Network Vulnerability Detection Approach for PHP Application
## 1 Introduction
However, they do not consider the structural characteristics of PHP script, which will lose a lot of semantic knowledge in code representation. Otherwise, GNNs (Graph Neural Networks) [19] can learn from the graph characteristics of source codes well. The existing methods transform the source code graph into a particular representation, such as AST (Abstract Syntax Tree), CFG (Control Flow Graph), DFG (Data Flow Graph), PDG (Program Dependence Graph), CPG (Code Property Graph), etc., which lack the grammatical features of source code [20]. Moreover, there are a few methods for PHP vulnerability detection using Graph Neural Networks. DeepTective [21] first investigated using GNN to detect vulnerabilities in PHP source code but just used CFG (Control Flow Graph) to represent the source code, lacking the data-dependent information, which is not conducive to vulnerability detection. To address the above problems, we propose a Graph Neural Network vulnerability detecting approach VulEye, based on a particular structure of SDG (Sub-Dependence Graph), which is a sub-graph of PDG. We combine the source code's control and data dependence features and put the source code line into the SDG's nodes attribute. The SDG integrates the token-level characteristics of the taint propagation chain into the corresponding graph nodes to realize vulnerability detection. In addition to the comprehensive structural features of source code, our approach with SDG can retain rich context semantic knowledge and has more suitable detection ability. This paper shows our contributions as follows:  
* Propose a novel Graph Neural Networks vulnerability detection approach, VulEye, for PHP application based on SDG, which contains source code skeleton information and the code token features embedding with Doc2 Vec [22]. It uses a GCN (Graph Convolutional Network) [23] with a global attention mechanism to learn the characteristics of vulnerabilities and classify them by MLP and softmax. This approach combines the source code's graph-level and token-level features so that it feeds the GNN (Graph Neural Network) model more details about the code and achieves better detection ability. * Propose an improved PHP-based code-slicing technique. It can automatically extract all the code slices related to the contamination propagation chain of a given sensitive API function in source code. There is no need to manually mark the entry point line number of the slice [24]. Moreover, VulEye can also locate the detailed location of vulnerability, since the SDG contains code slices closely related to vulnerabilities with a critical triggering sensitive/_sink_ function. * The experimental results show that the detection capability of VulEye is the best compared with the existing methods and other open-source detection implements. Based on the SARD's PHP vulnerability test suite dataset [25], VulEye achieved the best macro-average F1 score of 99% in the binary classification task and 95% in the multi-classes classification task. Compared with the state-of-the-art approach of DeepTective, VulEye achieves enhancements in all indicators. We further evaluate the generalization capability of VulEye with SQL-Labs [26] and XSS-Labs's [27]vulnerable PHP files, which achieved an accuracy of 88% and 72%.