Also not very clear what their call graph or "vuln related dependency prediction" task is all about, it almost looks like they are just pulling out symbols then 'guessing' if the symbols are calling functions? Like why are they using Jaccard similarity at all??