  Vulnerability detection is an important issue in software security. Although
various data-driven vulnerability detection methods have been proposed, the
task remains challenging since the diversity and complexity of real-world
vulnerable code in syntax and semantics make it difficult to extract vulnerable
features with regular deep learning models, especially in analyzing a large
program. Moreover, the fact that real-world vulnerable codes contain a lot of
redundant information unrelated to vulnerabilities will further aggravate the
above problem. To mitigate such challenges, we define a novel code
representation named Slice Property Graph (SPG), and then propose VulSPG, a new
vulnerability detection approach using the improved R-GCN model with triple
attention mechanism to identify potential vulnerabilities in SPG. Our approach
has at least two advantages over other methods. First, our proposed SPG can
reflect the rich semantics and explicit structural information that may be
relevance to vulnerabilities, while eliminating as much irrelevant information
as possible to reduce the complexity of graph. Second, VulSPG incorporates
triple attention mechanism in R-GCNs to achieve more effective learning of
vulnerability patterns from SPG. We have extensively evaluated VulSPG on two
large-scale datasets with programs from SARD and real-world projects.
Experimental results prove the effectiveness and efficiency of VulSPG.
