Rust Vulnerability Classification with WL-EnhancedLLVM-IR-Derived Code Property Graphs

Abstract Rust’s ownership paradigm provides substantial but not absolute safety; vulnerabilities may still arise from unsafe code, flawed logic, concurrency behavior, or insecure dependencies. This paper investigates whether security patterns can be distinguished using Code Property Graphs (CPGs) generated fromRust-produced LLVM Intermediate Representation (LLVM IR). The dataset was produced through are peatable workflow spanning RustSec-guided source collection, LLVM IR generation, CPG conversion, and JSON validation. After excluding malformed graphs and graphs exceeding the processing limit, the dataset comprised 235 CPGs—145 safe-labeled and 90 vulnerable-labeled. Each CPG was represented asa 182-dimensional hybrid vector combining pooled node attributes, a two-iteration Weisfeiler–Lehman(WL) neighborhood signature, and twenty graph-level descriptors. Three classifiers—XGBoost, RandomForest, and a radial basis function support vector machine—were evaluated on this representation, while a graph convolutional network (GCN) learned directly from CPG structure under five-fold stratified cross-validation partitions. XGBoost achieved the strongest observed performance, with78.81% balanced accuracy, a receiver operating characteristic area under the curve (ROC–AUC)of 0.9033, and a precision–recall area under the curve (PR–AUC) of 0.8603. Feature-component analysis shows an observed improvement when WL features are added to pooled node attributes forXGBoost, while pooled node attributes alone provide a strong predictive baseline and the handcrafted feature block produces a smaller, model-dependent change. A graph-size-grouped stress test showed a pronounced decline, indicating sensitivity to repeated graph-size signatures across folds. The study supports LLVM-IR-derived CPG embeddings for within-dataset vulnerability classification, while generalization to unseen crates and security advisories requires independent evaluation