CGKB: Grafo Heterogêneo para Consultas Semanticamente Tipadas sobre Código-Fonte
Resumo
A análise de código-fonte frequentemente exige consultas que combinam estrutura de controle e dependências de dados, como encontrar variáveis definidas dentro de loops e não reutilizadas posteriormente. Representações atuais em grafo ocultam essas distinções ou expõem código por meio de modelos internos de consulta. Este trabalho propõe e avalia o CGKB (Code Graph Knowledge Base), grafo heterogêneo para código Python com esquema explícito de nós e arestas. O CGKB integra relações de fluxo de controle e dependência de dados para viabilizar consultas semanticamente tipadas sobre código-fonte. O modelo foi construído para 114.998 soluções APPS e avaliado por cinco consultas representativas sobre 4.998 grafos em memória. Os resultados indicam 98,1% de cobertura de construção e latência mediana inferior a 10µs na implementação de referência em memória.
Palavras-chave:
Grafo Heterogêneo, Rede de Informação Heterogênea, Consulta sobre Código-Fonte, Fluxo de Controle, Dependência de Dados
Referências
Allen, F. E. (1970). Control flow analysis. ACM SIGPLAN Notices, 5(7):1–19.
Angonese, S. F. and Galante, R. (2024). Composition of heterogeneous node embeddings – unlocking the power of heterogeneous graph representation. In Simpósio Brasileiro de Banco de Dados (SBBD), pages 626–638. SBC.
Atzeni, M. and Atzori, M. (2017). CodeOntology: RDF-ization of source code. In International Semantic Web Conference (ISWC), volume 10588 of LNCS, pages 20–28. Springer.
Avgustinov, P., de Moor, O., Jones, M. P., and Schäfer, M. (2016). QL: Object-oriented queries on relational data. In 30th European Conference on Object-Oriented Programming (ECOOP), volume 56 of LIPIcs, pages 2:1–2:25. Schloss Dagstuhl – Leibniz-Zentrum für Informatik.
Cummins, C., Fisches, Z. V., Ben-Nun, T., Hoefler, T., O’Boyle, M. F. P., and Leather, H. (2021). Pro-GraML: A graph-based program representation for data flow analysis and compiler optimizations. In International Conference on Machine Learning (ICML), volume 139 of Proceedings of Machine Learning Research, pages 2244–2253. PMLR.
Ferrante, J., Ottenstein, K. J., and Warren, J. D. (1987). The program dependence graph and its use in optimization. ACM Transactions on Programming Languages and Systems (TOPLAS), 9(3):319–349.
Guo, D., Ren, S., Lu, S., Feng, Z., Tang, D., Liu, S., Zhou, L., Duan, N., Svyatkovskiy, A., Fu, S., Tufano, M., Deng, S. K., Clement, C., Drain, D., Sundaresan, N., Yin, J., Jiang, D., and Zhou, M. (2021). GraphCodeBERT: Pre-training code representations with data flow. In International Conference on Learning Representations (ICLR). OpenReview.net.
Hendrycks, D., Basart, S., Kadavath, S., Mazeika, M., Arora, A., Guo, E., Burns, C., Puranik, S., He, H., Song, D., and Steinhardt, J. (2021). Measuring coding challenge competence with APPS. In Advances in Neural Information Processing Systems (NeurIPS), Datasets and Benchmarks Track. Curran Associates.
Hu, Z., Dong, Y., Wang, K., and Sun, Y. (2020). Heterogeneous graph transformer. In The Web Conference (WWW), pages 2704–2710. ACM.
Liu, X., Lan, B., Hu, Z., Liu, Y., Zhang, Z., Wang, F., Shieh, M., and Zhou, W. (2025). CodexGraph: Bridging large language models and code repositories via code graph databases. In Proceedings of the 2025 Conference of the North American Chapter of the Association for Computational Linguistics (NAACL), pages 142–160. Association for Computational Linguistics.
Shen, M., Pillai, A. A., Yuan, B. A., Davis, J. C., and Machiry, A. (2025). Finding 709 defects in 258 projects: An experience report on applying CodeQL to open-source embedded software (experience paper). Proceedings of the ACM on Software Engineering, 2(ISSTA):1077–1100.
Song, S., Zhang, M., Li, S., and Liu, H. (2024). Learning heterogeneous abstract code graph representations for program comprehension. In 31st Asia-Pacific Software Engineering Conference (APSEC), pages 241–250. IEEE.
Sun, Y. and Han, J. (2012). Mining heterogeneous information networks: A structural analysis approach. ACM SIGKDD Explorations Newsletter, 14(2):20–28.
Sun, Y., Han, J., Yan, X., Yu, P. S., and Wu, T. (2022). Heterogeneous information networks: the past, the present, and the future. Proceedings of the VLDB Endowment (PVLDB), 15(12):3807–3811.
Vidal, V. M. P., Freitas, R., Arruda, N., Casanova, M. A., and Renso, C. (2024). A data design pattern for building and exploring semantic views of enterprise knowledge graphs. In Simpósio Brasileiro de Banco de Dados (SBBD), pages 1–13. SBC.
Weiser, M. (1984). Program slicing. IEEE Transactions on Software Engineering, SE-10(4):352–357.
Yamaguchi, F., Golde, N., Arp, D., and Rieck, K. (2014). Modeling and discovering vulnerabilities with code property graphs. In IEEE Symposium on Security and Privacy (S&P), pages 590–604. IEEE.
Yamaguchi, F., Lottmann, M., and Rieck, K. (2012). Generalized vulnerability extrapolation using abstract syntax trees. In Annual Computer Security Applications Conference (ACSAC), pages 359–368. ACM.
Zhang, T., Xu, R., Zhang, J., Liu, Y., Chen, X., Yin, J., and Zheng, X. (2024). DSHGT: Dual-supervisors heterogeneous graph transformer – a pioneer study of using heterogeneous graph learning for detecting software vulnerabilities. ACM Transactions on Software Engineering and Methodology (TOSEM), 33(8):1–31.
Angonese, S. F. and Galante, R. (2024). Composition of heterogeneous node embeddings – unlocking the power of heterogeneous graph representation. In Simpósio Brasileiro de Banco de Dados (SBBD), pages 626–638. SBC.
Atzeni, M. and Atzori, M. (2017). CodeOntology: RDF-ization of source code. In International Semantic Web Conference (ISWC), volume 10588 of LNCS, pages 20–28. Springer.
Avgustinov, P., de Moor, O., Jones, M. P., and Schäfer, M. (2016). QL: Object-oriented queries on relational data. In 30th European Conference on Object-Oriented Programming (ECOOP), volume 56 of LIPIcs, pages 2:1–2:25. Schloss Dagstuhl – Leibniz-Zentrum für Informatik.
Cummins, C., Fisches, Z. V., Ben-Nun, T., Hoefler, T., O’Boyle, M. F. P., and Leather, H. (2021). Pro-GraML: A graph-based program representation for data flow analysis and compiler optimizations. In International Conference on Machine Learning (ICML), volume 139 of Proceedings of Machine Learning Research, pages 2244–2253. PMLR.
Ferrante, J., Ottenstein, K. J., and Warren, J. D. (1987). The program dependence graph and its use in optimization. ACM Transactions on Programming Languages and Systems (TOPLAS), 9(3):319–349.
Guo, D., Ren, S., Lu, S., Feng, Z., Tang, D., Liu, S., Zhou, L., Duan, N., Svyatkovskiy, A., Fu, S., Tufano, M., Deng, S. K., Clement, C., Drain, D., Sundaresan, N., Yin, J., Jiang, D., and Zhou, M. (2021). GraphCodeBERT: Pre-training code representations with data flow. In International Conference on Learning Representations (ICLR). OpenReview.net.
Hendrycks, D., Basart, S., Kadavath, S., Mazeika, M., Arora, A., Guo, E., Burns, C., Puranik, S., He, H., Song, D., and Steinhardt, J. (2021). Measuring coding challenge competence with APPS. In Advances in Neural Information Processing Systems (NeurIPS), Datasets and Benchmarks Track. Curran Associates.
Hu, Z., Dong, Y., Wang, K., and Sun, Y. (2020). Heterogeneous graph transformer. In The Web Conference (WWW), pages 2704–2710. ACM.
Liu, X., Lan, B., Hu, Z., Liu, Y., Zhang, Z., Wang, F., Shieh, M., and Zhou, W. (2025). CodexGraph: Bridging large language models and code repositories via code graph databases. In Proceedings of the 2025 Conference of the North American Chapter of the Association for Computational Linguistics (NAACL), pages 142–160. Association for Computational Linguistics.
Shen, M., Pillai, A. A., Yuan, B. A., Davis, J. C., and Machiry, A. (2025). Finding 709 defects in 258 projects: An experience report on applying CodeQL to open-source embedded software (experience paper). Proceedings of the ACM on Software Engineering, 2(ISSTA):1077–1100.
Song, S., Zhang, M., Li, S., and Liu, H. (2024). Learning heterogeneous abstract code graph representations for program comprehension. In 31st Asia-Pacific Software Engineering Conference (APSEC), pages 241–250. IEEE.
Sun, Y. and Han, J. (2012). Mining heterogeneous information networks: A structural analysis approach. ACM SIGKDD Explorations Newsletter, 14(2):20–28.
Sun, Y., Han, J., Yan, X., Yu, P. S., and Wu, T. (2022). Heterogeneous information networks: the past, the present, and the future. Proceedings of the VLDB Endowment (PVLDB), 15(12):3807–3811.
Vidal, V. M. P., Freitas, R., Arruda, N., Casanova, M. A., and Renso, C. (2024). A data design pattern for building and exploring semantic views of enterprise knowledge graphs. In Simpósio Brasileiro de Banco de Dados (SBBD), pages 1–13. SBC.
Weiser, M. (1984). Program slicing. IEEE Transactions on Software Engineering, SE-10(4):352–357.
Yamaguchi, F., Golde, N., Arp, D., and Rieck, K. (2014). Modeling and discovering vulnerabilities with code property graphs. In IEEE Symposium on Security and Privacy (S&P), pages 590–604. IEEE.
Yamaguchi, F., Lottmann, M., and Rieck, K. (2012). Generalized vulnerability extrapolation using abstract syntax trees. In Annual Computer Security Applications Conference (ACSAC), pages 359–368. ACM.
Zhang, T., Xu, R., Zhang, J., Liu, Y., Chen, X., Yin, J., and Zheng, X. (2024). DSHGT: Dual-supervisors heterogeneous graph transformer – a pioneer study of using heterogeneous graph learning for detecting software vulnerabilities. ACM Transactions on Software Engineering and Methodology (TOSEM), 33(8):1–31.
Publicado
08/09/2026
Como Citar
GONÇALVES, Jader Louis de Souza; WATANABE, Carolina Yukari Veludo.
CGKB: Grafo Heterogêneo para Consultas Semanticamente Tipadas sobre Código-Fonte. In: SIMPÓSIO BRASILEIRO DE BANCO DE DADOS (SBBD), 41. , 2026, São Carlos/SP.
Anais [...].
Porto Alegre: Sociedade Brasileira de Computação,
2026
.
p. 1036-1042.
ISSN 2763-8979.
DOI: https://doi.org/10.5753/sbbd.2026.249663.
