AI-powered security analysis using GraphCodeBERT with AST+DFG features
Detects SQL injection, XSS, command injection, and other vulnerabilities in JavaScript code through deep learning.
| Accuracy | Precision | Recall | F1 Score |
|---|---|---|---|
| 79.21% | 59.42% | 88.40% | 69.40% |
Pipeline: Code → Feature Extraction → GraphCodeBERT Encoder → Graph Reasoning → Classification
The model processes JavaScript code through 6 main layers:
Layer 0 - Data Processing
Layer 1 - Feature Extraction
- AST (Abstract Syntax Tree): Captures code structure using Tree-sitter
- DFG (Data Flow Graph): Tracks how data flows between variables
Layer 2 - GraphCodeBERT Encoder (125M parameters)
- Pre-trained on 2.3M code samples with data flow awareness
- 12 transformer layers process code tokens
- Outputs contextualized embeddings that understand code semantics
Layer 3 - Graph Attention Network
- 2 GAT layers use the adjacency matrix to reason about code structure
- Learns which code relationships matter for security
- Residual connections maintain information flow
Layer 4 - Multi-Modal Fusion
- Combines learned code embeddings (768-dim)
- With traditional code metrics (15 features: complexity, LOC, Halstead, etc.)
- Creates rich 832-dimensional representation
Layer 5 - Classification
- 3-layer neural network processes fused features
- Outputs probability: Safe vs Vulnerable
- Uses Focal Loss to handle class imbalance
( Currently working on balancing precision and recall for better performance)