{"id":"https://openalex.org/W7213445259","doi":"https://doi.org/10.53941/tgina.2026.100005","title":"Program Graph Learning for Software Vulnerability Analysis: A Survey","display_name":"Program Graph Learning for Software Vulnerability Analysis: A Survey","publication_year":2026,"publication_date":"2026-09-09","ids":{"openalex":"https://openalex.org/W7213445259","doi":"https://doi.org/10.53941/tgina.2026.100005"},"language":"en","primary_location":{"id":"doi:10.53941/tgina.2026.100005","doi":"https://doi.org/10.53941/tgina.2026.100005","is_oa":true,"landing_page_url":"https://doi.org/10.53941/tgina.2026.100005","pdf_url":"https://media.sciltp.com/articles/2609005091/2609005091.pdf","source":{"id":"https://openalex.org/S7407065001","display_name":"Transactions on Graph Intelligence and Network Applications","issn_l":"3083-094X","issn":["3083-094X"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Transactions on Graph Intelligence and Network Applications","raw_type":"journal-article"},"volume":null,"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://media.sciltp.com/articles/2609005091/2609005091.pdf","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5044057440","display_name":"Tong Yu","orcid":"https://orcid.org/0000-0002-5307-3516","observed_orcids":["https://orcid.org/0000-0002-5307-3516"]},"institutions":[{"id":"https://openalex.org/I37461747","display_name":"Wuhan University","ror":"https://ror.org/033vjfk17","country_code":"CN","type":"education","lineage":["https://openalex.org/I37461747"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Tong Yu","raw_affiliation_strings":["School of Computer Science, Wuhan University, Wuhan 430072, China"],"raw_orcid":"https://orcid.org/0000-0002-5307-3516","affiliations":[{"raw_affiliation_string":"School of Computer Science, Wuhan University, Wuhan 430072, China","institution_ids":["https://openalex.org/I37461747"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5151989961","display_name":"Junjie Wang","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I37461747","display_name":"Wuhan University","ror":"https://ror.org/033vjfk17","country_code":"CN","type":"education","lineage":["https://openalex.org/I37461747"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Junjie Wang","raw_affiliation_strings":["School of Computer Science, Wuhan University, Wuhan 430072, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computer Science, Wuhan University, Wuhan 430072, China","institution_ids":["https://openalex.org/I37461747"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5151971542","display_name":"Ming Li","orcid":"https://orcid.org/0000-0002-1218-2804","observed_orcids":["https://orcid.org/0000-0002-1218-2804"]},"institutions":[{"id":"https://openalex.org/I135237710","display_name":"Zhejiang Normal University","ror":"https://ror.org/01vevwk45","country_code":"CN","type":"education","lineage":["https://openalex.org/I135237710"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ming Li","raw_affiliation_strings":["Zhejiang Key Laboratory of Intelligent Education Technology and Application, Zhejiang Normal University, Jinhua 321017, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Zhejiang Key Laboratory of Intelligent Education Technology and Application, Zhejiang Normal University, Jinhua 321017, China","institution_ids":["https://openalex.org/I135237710"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5027598109","display_name":"Yuhang Hu","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I37461747","display_name":"Wuhan University","ror":"https://ror.org/033vjfk17","country_code":"CN","type":"education","lineage":["https://openalex.org/I37461747"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuhang Hu","raw_affiliation_strings":["School of Computer Science, Wuhan University, Wuhan 430072, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computer Science, Wuhan University, Wuhan 430072, China","institution_ids":["https://openalex.org/I37461747"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5150681466","display_name":"Junwei Hu","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I37461747","display_name":"Wuhan University","ror":"https://ror.org/033vjfk17","country_code":"CN","type":"education","lineage":["https://openalex.org/I37461747"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Junwei Hu","raw_affiliation_strings":["School of Computer Science, Wuhan University, Wuhan 430072, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computer Science, Wuhan University, Wuhan 430072, China","institution_ids":["https://openalex.org/I37461747"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5150671415","display_name":"Xiantao Cai","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I37461747","display_name":"Wuhan University","ror":"https://ror.org/033vjfk17","country_code":"CN","type":"education","lineage":["https://openalex.org/I37461747"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiantao Cai","raw_affiliation_strings":["School of Computer Science, Wuhan University, Wuhan 430072, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computer Science, Wuhan University, Wuhan 430072, China","institution_ids":["https://openalex.org/I37461747"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5067304607","display_name":"Wenbin Hu","orcid":"https://orcid.org/0000-0002-4452-7176","observed_orcids":["https://orcid.org/0000-0002-4452-7176","https://orcid.org/0009-0006-8016-7039"]},"institutions":[{"id":"https://openalex.org/I37461747","display_name":"Wuhan University","ror":"https://ror.org/033vjfk17","country_code":"CN","type":"education","lineage":["https://openalex.org/I37461747"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Wenbin Hu","raw_affiliation_strings":["School of Computer Science, Wuhan University, Wuhan 430072, China","Wuhan University Shenzhen Research Institute, Shenzhen 518057, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computer Science, Wuhan University, Wuhan 430072, China","institution_ids":["https://openalex.org/I37461747"]},{"raw_affiliation_string":"Wuhan University Shenzhen Research Institute, Shenzhen 518057, China","institution_ids":["https://openalex.org/I37461747"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5116925224","display_name":"Alessio Borgi","orcid":"https://orcid.org/0009-0007-1979-0857","observed_orcids":["https://orcid.org/0009-0007-1979-0857"]},"institutions":[{"id":"https://openalex.org/I241749","display_name":"University of Cambridge","ror":"https://ror.org/013meh722","country_code":"GB","type":"education","lineage":["https://openalex.org/I241749"]},{"id":"https://openalex.org/I861853513","display_name":"Sapienza University of Rome","ror":"https://ror.org/02be6w209","country_code":"IT","type":"education","lineage":["https://openalex.org/I861853513"]}],"countries":["GB","IT"],"is_corresponding":false,"raw_author_name":"Alessio Borgi","raw_affiliation_strings":["Department of Computer Science and Technology, University of Cambridge, Cambridge CB3 0FD, UK","Department of Computer, Control and Management Engineering, Sapienza University of Rome, 00185 Rome, Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science and Technology, University of Cambridge, Cambridge CB3 0FD, UK","institution_ids":["https://openalex.org/I241749"]},{"raw_affiliation_string":"Department of Computer, Control and Management Engineering, Sapienza University of Rome, 00185 Rome, Italy","institution_ids":["https://openalex.org/I861853513"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.66380611,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.7461000084877014,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.7461000084877014,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.14380000531673431,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.04830000177025795,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/software-vulnerability-detection","display_name":"software vulnerability detection","score":0.8050000071525574},{"id":"https://openalex.org/keywords/graph-representation-learning","display_name":"graph representation learning","score":0.8529999852180481},{"id":"https://openalex.org/keywords/large-language-models","display_name":"large language models","score":0.777999997138977},{"id":"https://openalex.org/keywords/vulnerability-localization","display_name":"vulnerability localization","score":0.8700000047683716},{"id":"https://openalex.org/keywords/vulnerability-classification","display_name":"vulnerability classification","score":0.8130000233650208},{"id":"https://openalex.org/keywords/vulnerability-remediation","display_name":"vulnerability remediation","score":0.9850000143051147},{"id":"https://openalex.org/keywords/cross-lingual-generalization","display_name":"cross-lingual generalization","score":0.8320000171661377},{"id":"https://openalex.org/keywords/interpretability","display_name":"interpretability","score":0.875},{"id":"https://openalex.org/keywords/noisy-labels","display_name":"label noise","score":0.7229999899864197},{"id":"https://openalex.org/keywords/benchmark-standardization","display_name":"benchmark standardization","score":0.890999972820282}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7698000073432922},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.7106999754905701},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.5065000057220459},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.4666999876499176},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.4058000147342682},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.38580000400543213},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3711000084877014},{"id":"https://openalex.org/C2775945657","wikidata":"https://www.wikidata.org/wiki/Q381442","display_name":"Structuring","level":2,"score":0.3684999942779541},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.3571000099182129},{"id":"https://openalex.org/C161301231","wikidata":"https://www.wikidata.org/wiki/Q3478658","display_name":"Knowledge representation and reasoning","level":2,"score":0.3560999929904938},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.35600000619888306},{"id":"https://openalex.org/C117447612","wikidata":"https://www.wikidata.org/wiki/Q1412670","display_name":"Software quality","level":4,"score":0.31949999928474426},{"id":"https://openalex.org/C2776359362","wikidata":"https://www.wikidata.org/wiki/Q2145286","display_name":"Representation (politics)","level":3,"score":0.3061000108718872},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3046000003814697},{"id":"https://openalex.org/C12713177","wikidata":"https://www.wikidata.org/wiki/Q1900281","display_name":"Perspective (graphical)","level":2,"score":0.29679998755455017},{"id":"https://openalex.org/C137287247","wikidata":"https://www.wikidata.org/wiki/Q1329550","display_name":"Static program analysis","level":4,"score":0.29170000553131104},{"id":"https://openalex.org/C98183937","wikidata":"https://www.wikidata.org/wiki/Q2112188","display_name":"Program analysis","level":2,"score":0.29159998893737793},{"id":"https://openalex.org/C59404180","wikidata":"https://www.wikidata.org/wiki/Q17013334","display_name":"Feature learning","level":2,"score":0.2906000018119812},{"id":"https://openalex.org/C149091818","wikidata":"https://www.wikidata.org/wiki/Q2429814","display_name":"Software system","level":3,"score":0.28369998931884766},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.2822999954223633},{"id":"https://openalex.org/C529173508","wikidata":"https://www.wikidata.org/wiki/Q638608","display_name":"Software development","level":3,"score":0.2777000069618225},{"id":"https://openalex.org/C172776598","wikidata":"https://www.wikidata.org/wiki/Q7943570","display_name":"Vulnerability management","level":4,"score":0.26579999923706055},{"id":"https://openalex.org/C2779530757","wikidata":"https://www.wikidata.org/wiki/Q1207505","display_name":"Quality (philosophy)","level":2,"score":0.26579999923706055},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.25690001249313354},{"id":"https://openalex.org/C2779639559","wikidata":"https://www.wikidata.org/wiki/Q7661178","display_name":"Symbolic execution","level":3,"score":0.25540000200271606},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.25130000710487366}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.53941/tgina.2026.100005","doi":"https://doi.org/10.53941/tgina.2026.100005","is_oa":true,"landing_page_url":"https://doi.org/10.53941/tgina.2026.100005","pdf_url":"https://media.sciltp.com/articles/2609005091/2609005091.pdf","source":{"id":"https://openalex.org/S7407065001","display_name":"Transactions on Graph Intelligence and Network Applications","issn_l":"3083-094X","issn":["3083-094X"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Transactions on Graph Intelligence and Network Applications","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.53941/tgina.2026.100005","doi":"https://doi.org/10.53941/tgina.2026.100005","is_oa":true,"landing_page_url":"https://doi.org/10.53941/tgina.2026.100005","pdf_url":"https://media.sciltp.com/articles/2609005091/2609005091.pdf","source":{"id":"https://openalex.org/S7407065001","display_name":"Transactions on Graph Intelligence and Network Applications","issn_l":"3083-094X","issn":["3083-094X"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Transactions on Graph Intelligence and Network Applications","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[{"id":"https://openalex.org/G5231514933","display_name":null,"funder_award_id":"2025A1515012155","funder_id":"https://openalex.org/F4320321921","funder_display_name":"Natural Science Foundation of Guangdong Province"},{"id":"https://openalex.org/G5774602305","display_name":null,"funder_award_id":"JCYJ20230807090211021","funder_id":"https://openalex.org/F4320316880","funder_display_name":"Natural Science Foundation of Shenzhen City"},{"id":"https://openalex.org/G8173149730","display_name":null,"funder_award_id":"62476203","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320316880","display_name":"Natural Science Foundation of Shenzhen City","ror":null},{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320321921","display_name":"Natural Science Foundation of Guangdong Province","ror":null},{"id":"https://openalex.org/F4320322186","display_name":"Natural Science Foundation of Hubei Province","ror":null}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7213445259.pdf","grobid_xml":"https://content.openalex.org/works/W7213445259.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W4394994998","https://openalex.org/W7161575815","https://openalex.org/W4402402677","https://openalex.org/W7171564884","https://openalex.org/W7204844785","https://openalex.org/W4416249193","https://openalex.org/W7156652120","https://openalex.org/W7208828543","https://openalex.org/W4388184488","https://openalex.org/W4211027502"],"abstract_inverted_index":{"Software":[0],"vulnerabilities":[1],"represent":[2],"an":[3],"enduring":[4],"threat":[5],"to":[6],"modern":[7],"cyberspace.":[8],"Effective":[9],"vulnerability":[10,52,83,97,121,157,178],"detection":[11],"increasingly":[12],"relies":[13],"on":[14,64],"reasoning":[15],"about":[16],"complex":[17],"program":[18,60,129],"semantics,":[19],"structural":[20],"dependencies,":[21],"and":[22,46,65,76,89,105,120,133,147,155,176],"execution":[23],"behaviors.":[24],"Consequently,":[25],"extracting":[26],"vulnerability-relevant":[27],"features":[28],"from":[29],"code":[30],"efficiently":[31],"has":[32],"become":[33],"a":[34,55,108],"pressing":[35],"research":[36],"issue.":[37],"In":[38],"recent":[39,93],"years,":[40],"advances":[41],"in":[42,95],"graph":[43,56,130],"representation":[44],"learning":[45,57],"large":[47],"language":[48],"models":[49],"have":[50],"reframed":[51],"analysis":[53],"as":[54],"problem":[58],"over":[59],"entities.":[61],"By":[62],"building":[63],"extending":[66],"traditional":[67],"methods":[68],"including":[69],"static":[70],"analysis,":[71,73],"dynamic":[72],"symbolic":[74],"execution,":[75],"fuzzing,":[77],"this":[78],"perspective":[79],"enables":[80],"more":[81],"effective":[82],"detection,":[84],"fine-grained":[85],"localization,":[86],"multi-class":[87],"classification,":[88],"repair.":[90],"We":[91,136],"review":[92],"progress":[94],"graph-driven":[96],"intelligence,":[98],"structuring":[99],"the":[100,150],"survey":[101],"around":[102],"these":[103],"tasks":[104],"then":[106,137],"providing":[107],"structured":[109],"overview":[110],"of":[111,152],"representative":[112],"graph-based":[113,115],"methods,":[114,117,119,123],"multimodal":[116],"LLM-assisted":[118],"repair":[122],"together":[124],"with":[125],"widely":[126],"adopted":[127],"datasets,":[128],"construction":[131],"tools,":[132],"computing":[134],"frameworks.":[135],"highlight":[138],"several":[139],"persistent":[140],"challenges:":[141],"interpretability,":[142],"cross-language":[143],"generalization,":[144],"data":[145],"quality":[146],"label":[148],"noise,":[149],"lack":[151],"benchmark":[153],"standardization,":[154],"agent-oriented":[156],"analysis.":[158],"These":[159],"challenges":[160],"are":[161],"often":[162],"intertwined,":[163],"complicating":[164],"piecemeal":[165],"solutions.":[166],"Addressing":[167],"them":[168],"will":[169],"be":[170],"critical":[171],"for":[172],"developing":[173],"reliable,":[174],"transferable,":[175],"explainable":[177],"intelligence":[179],"systems.":[180]},"counts_by_year":[],"updated_date":"2026-10-13T10:08:12.033832","created_date":"2026-09-17T00:00:00"}