# VulEye: A Novel Graph Neural Network Vulnerability Detection Approach for PHP Application
## 4 Proposed Approach
### Stage III: Deep Learning Algorithm  
Figure 5 shows details of our deep learning model, including three basic module units, which consist of a graph convolution layer, a graph pooling layer, and an attention layer. We stack the three cell modules, where the output of the last cell is used as the input of the next cell. Finally, we sum the output of each cell, and the result is the eigenvector learned by the model from the input SDG diagram sample. **Graph Convolutional Network (GCN) layer. ** GCN [23] is a feature extractor that can automatically learn node features and the correlation features between nodes [45]. The GCN implements an efficient method of extracting features from graph data and is perfect for node classification, graph classification, and link prediction. It can also obtain graph embedding. Suppose a graph's data have N nodes, and each node has its characteristics. The features of these nodes form an \(N\times D\) dimension matrix \(X\). The relationship between the nodes will form an \(N\times N\)-dimensional matrix \(A\), also known as an adjacency matrix. \(X\) and \(A\) are the inputs of the GCN model. The propagation mode between layers of neural networks in the GCN model is as follows (7):  
\[H^{l+1}=\sigma(\bar{D}^{-\frac{1}{2}}\bar{A}\bar{D}^{-\frac{1}{2}}H^{l}W^{l}) \tag{7}\]  
Figure 4: Doc2 vec. Figure 5: VulEye deep learning model. \(H\) is the feature of each hidden layer, and \(H=X\) for the input layer. \(\sigma(\cdot)\) is a nonlinear activation function. \(W\) is the node weight matrix. \(\tilde{A}=A+I\), \(I\) is identity matrix. \(\tilde{D}\) is the degree matrix of \(\tilde{A}\), and the calculation formula is (8):  
\[\tilde{D_{ii}}=\sum_{j}\tilde{A_{ij}} \tag{8}\]  
Finally, the \(\tilde{D}^{-\frac{1}{2}}\tilde{A}\tilde{D}^{-\frac{1}{2}}\) can be calculated by (9)  
\[\tilde{D}^{-\frac{1}{2}}\tilde{A}\tilde{D}^{-\frac{1}{2}}=\sum_{j}\frac{1}{ \sqrt{\tilde{D_{ii}}\tilde{D_{jj}}}}\tilde{A_{ij}}H_{j} \tag{9}\]  
The core idea of GCN is to aggregate node information by using edge information to generate a new representation of nodes. Its fundamental idea is to extract the graph's spatial topological characteristic. In other words, it is a feature extractor that can automatically learn the node features of the input graph and the association features between nodes. Therefore, it is very suitable for classification tasks at the graph level. According to (7), we use _ReLU_ as the activation function in our training model. **Top-k Graph Pooling layer. ** In a CNN (Convolutional Neural Network), the pooling layer can effectively reduce the number of model parameters, thus avoiding model overfitting. Similarly, in the Graph Neural Network, a hierarchical pooling layer can play a similar role in the graph structure, especially in complex and large-scale graph classification tasks, because these diagrams usually contain rich hierarchies, which are very important for diagram classification tasks. In this paper, we choose the Top-k pooling model [45] as the graph pooling layer to learn the hierarchical structure of the nodes in the graph and further extract the node features that have a close relationship with the graph-level feature representation. Therefore, it will reduce the dimension of the output feature vector, reduce the computational load of the subsequent neural network layer, and to some extent, avoid the overfitting of the model. The model performs inverse sorting by calculating the projection score of each node feature vector on a global basis vector, which is automatically learnable. Then, it selects the top \(\lceil kN\rceil\) nodes, where \(k\in(0,1)\) is the pooling ratio, and N is the total number of nodes in the original graph. The specific calculation principle is as follows (10), (11), (12), and (13):  
\[y=\frac{H^{l}p^{l}}{\|p^{l}\|} \tag{10}\]  
\[idx=toprank(y,k) \tag{11}\]  
\[A^{l+1}=A^{l}_{(idx,idx)} \tag{12}\]  
\[H^{l+1}=(H^{l}\odot tanh(y))_{idx} \tag{13}\]  
where \(p\) is a learnable basis vector. \(y\) is the projection score of the node on the basis vector.