Research

Developing a novel Siamese Differential Relational Graph Neural Network (Diff-CPG-GNN) to discover latent zero-day vulnerabilities in patched software functions. Evaluated across 40,863 real-world C functions from the Linux Kernel, Chromium, Android, and ImageMagick, outperforming SOTA baselines (HYDRA, Devign, LineVul) with a 0.9101 ROC-AUC and 0.7565 F1-score on cross-project benchmarks.

Remediating software vulnerabilities via developer-authored patches is the cornerstone of modern defensive engineering. However, patches developed under severe release pressure frequently suffer from incomplete root-cause comprehension, incorrect boundary checks, or unintended side-effects, leaving behind latent or residual zero-day vulnerabilities within the modified code. While recent pioneering efforts such as HYDRA (AST '26) established the prevalence of residual post-patch risks using handcrafted regex heuristics and unsupervised Variational Autoencoders (VAEs), their reliance on syntactic regex templates and single-snapshot representations fundamentally inhibits their ability to capture fine-grained semantic structural changes between pre-patch and post-patch code.

In this paper, we propose Diff-CPG-GNN, a deep supervised Siamese Differential Relational Graph Neural Network architecture designed for out-of-distribution, cross-project latent zero-day vulnerability discovery. Diff-CPG-GNN models pre-patch and post-patch functions as Multi-Relational Code Property Graphs (CPGs) that jointly integrate Abstract Syntax Trees (AST), Control Flow Graphs (CFG), Control Dependencies, and Dataflow relations. It encodes both graph structures through a shared 4-layer Relational Graph Attention Network (RGAT) equipped with stochastic edge dropout, and isolates the precise semantic transformation of the patch via a bidirectional Siamese cross-attention difference operator.

We evaluate Diff-CPG-GNN on the authentic Big-Vul benchmark, training exclusively on 20,451 patched C functions from the Linux kernel and conducting zero-shot cross-project testing on 20,412 unseen patched functions across three external software ecosystems: Chrome (16,387 functions), Android (2,322 functions), and ImageMagick (1,703 functions). Our extensive empirical results demonstrate that Diff-CPG-GNN establishes a new state of the art, achieving a ROC-AUC of 0.9101 on Chrome (+36.8% over HYDRA), 0.9136 on Android (+30.4%), and 0.8450 on ImageMagick (+16.5%), while advancing the F1-score to 0.7565 on Chrome (4.15x over HYDRA) and 0.7551 on Android (2.94x).