Program Graph Learning for Software Vulnerability Analysis: A Survey

Abstract

Software vulnerabilities represent an enduring threat to modern cyberspace. Effective vulnerability detection increasingly relies on reasoning about complex program semantics, structural dependencies, and execution behaviors. Consequently, extracting vulnerability-relevant features from code efficiently has become a pressing research issue. In recent years, advances in graph representation learning and large language models have reframed vulnerability analysis as a graph learning problem over program entities. By building on and extending traditional methods including static analysis, dynamic analysis, symbolic execution, and fuzzing, this perspective enables more effective vulnerability detection, fine-grained localization, multi-class classification, and repair. We review recent progress in graph-driven vulnerability intelligence, structuring the survey around these tasks and then providing a structured overview of representative graph-based methods, graph-based multimodal methods, LLM-assisted methods, and vulnerability repair methods, together with widely adopted datasets, program graph construction tools, and computing frameworks. We then highlight several persistent challenges: interpretability, cross-language generalization, data quality and label noise, the lack of benchmark standardization, and agent-oriented vulnerability analysis. These challenges are often intertwined, complicating piecemeal solutions. Addressing them will be critical for developing reliable, transferable, and explainable vulnerability intelligence systems.