Bridging topological and feature spaces: A dual channel graph neural network for vulnerability detection

Sequence-based deep learning approaches often struggle to capture the rich structural characteristics of source code, while existing GNNs exhibit limited capability in modeling long-range dependencies and tend to overlook valuable information encoded in the feature space of code graphs. To address these limitations, we propose TFDG ( T opological- F eature D ual-space G raph Neural Network), a novel GNN-based framework that jointly models the topological structure and feature space for software vulnerability detection.In TFDG, source code is first transformed into a CPG using Joern, and Word2Vec is employed to generate initial node representations. In the topological space channel, the graph structure is progressively simplified by a TOPK algorithm that leverages Graph Convolutional Networks (GCNs) outputs as node importance scores, with corresponding updates applied to both the adjacency matrix and node features. This process effectively shortens long-range dependencies by reducing graph complexity. In parallel, the feature space channel focuses on extracting latent semantic information by performing feature compression and multi-layer feature relationship modeling. To handle variable-sized graphs, we introduce a Masking algorithm to explicitly distinguish valid nodes from padded nodes, thereby preventing padding-induced noise during batch processing. Finally, a gating mechanism dynamically fuses the representations learned from the two channels to produce the final detection results.Extensive experiments conducted on three publicly available datasets demonstrate that TFDG consistently outperforms most GNN-based baseline methods in terms of Accuracy, Precision, Recall, and F 1 score. Further analysis shows that the topological and feature space channels capture complementary information, enabling more robust and comprehensive vulnerability detection. These results indicate that dual-space modeling provides an effective solution for addressing the limitations of existing graph-based vulnerability detection approaches.