用图神经网络补全JavaScript调用图，提升漏洞检测准确性。
Call Me Maybe: Enhancing JavaScript Call Graph Construction using Graph Neural Networks
- 将调用图缺失边问题转化为多类型边的图神经网络链接预测。
- 在50个热门库上，42%的未解析调用点正确目标排第一，72%内排前五。
- 适合做静态分析、安全审计的开发者，尤其关注代码调用关系的人。
静态分析在发现漏洞（包括安全问题）中至关重要，其核心是构建准确的调用图以建模程序中的函数调用。然而，由于JavaScript语言特性复杂，现有调用图构造算法既不完全也不可靠，先进方法仍存在误报和漏报。本文提出GRAPHIA，通过图神经网络辅助识别遗漏的调用边。将问题建模为完整程序图上的链接预测，使用语法与语义结合的多类型边表示。该方法可学习不完美标签：包括现有工具生成的静态边和测试生成的动态边（来自同一或不同项目）。因调用图稀疏，采用排名评估而非传统指标。在50个流行JavaScript库上进行大规模评估，共含16.3万条调用边（15万静态，1.3万动态），构建出包含660万结构边和38.6万语义边的程序图。对于未解析调用点，正确目标在前5名内的比例达72%，排名第一的比例超过42%，显著降低人工分析负担。结果表明，基于学习的方法能有效提升调用图召回率。据我们所知，这是首个将GNN链接预测应用于跨文件全程序图的上下文间分析工作。
原文摘要 · Abstract (English)
Static analysis plays a key role in finding bugs, including security issues. A critical step in static analysis is building accurate call graphs that model function calls in a program. However, due to hard-to-analyze language features, existing call graph construction algorithms for JavaScript are neither sound nor complete. Prior work shows that even advanced solutions produce false edges and miss valid ones. In this work, we assist these tools by identifying missed call edges. Our main idea is to frame the problem as link prediction on full program graphs, using a rich representation with multiple edge types. Our approach, GRAPHIA, leverages recent advances in graph neural networks to model non-local relationships between code elements. Concretely, we propose representing JavaScript programs using a combination of syntactic- and semantic-based edges. GRAPHIA can learn from imperfect labels, including static call edges from existing tools and dynamic edges from tests, either from the same or different projects. Because call graphs are sparse, standard machine learning metrics like ROC are not suitable. Instead, we evaluate GRAPHIA by ranking function definitions for each unresolved call site. We conduct a large-scale evaluation on 50 popular JavaScript libraries with 163K call edges (150K static and 13K dynamic). GRAPHIA builds program graphs with 6.6M structural and 386K semantic edges. It ranks the correct target as the top candidate in over 42% of unresolved cases and within the top 5 in 72% of cases, reducing the manual effort needed for analysis. Our results show that learning-based methods can improve the recall of JavaScript call graph construction. To our knowledge, this is the first work to apply GNN-based link prediction to full multi-file program graphs for interprocedural analysis.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。