Multi-modal long text vulnerability classification method based on transfer learning and loss adjustment

Abstract

The invention provides a multi-modal long text vulnerability classification method based on transfer learning and loss adjustment, belongs to the technical field of computers, and solves the technical problems that an existing method is low in classification accuracy and poor in generalization ability. Comprising the following steps: S1, preprocessing a data set; s2, dividing a training set, a verification set and a test set; s3, splicing the bimodal information of the vulnerability description and the code information into long text input, and designing a sliding window segmentation fusion method; s4, finely adjusting the pre-training language model to complete a vulnerability assessment task, and adopting an early stop strategy; s5, migrating knowledge learned in the evaluation task to a vulnerability classification task; s6, designing a dynamic loss function adjustment mechanism to carry out weight adjustment; and S7, inputting test set data into the trained model, and performing vulnerability classification prediction. The method has the beneficial effect that the performance of the vulnerability classification task is improved through transfer learning and loss adjustment.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a multimodal long text vulnerability classification method based on transfer learning and loss adjustment. Background Art

[0002] With the rapid development of digitalization and informatization, software systems have become deeply embedded in every aspect of social life. However, as software scale and complexity continue to increase, software vulnerabilities have become increasingly prominent and have become a key threat to software security. Simultaneously, the diversity and prevalence of vulnerabilities have also increased accordingly. Therefore, timely and accurate vulnerability identification and remediation have become crucial to ensuring system security and integrity.

[0003] Software vulnerability classification plays a crucial role in developing effective and targeted remediation strategies during the vulnerability remediation process. However, current vulnerability classification tasks often face the challenge of insufficient labeled data, especially for rare or complex vulnerability types. Furthermore, the long-tail problem in vulnerability type datasets is not negligible, resulting in a highly imbalanced distribution of vulnerability types. Specifically, a small number of head classes contain a large number of samples, while the remaining numerous tail classes consist of only a small number of samples. This imbalance severely impacts the classification accuracy of existing methods.

[0004] Currently, most software vulnerability classification models rely on a single type of vulnerability information, such as source code or description, for classification, which fails to fully capture vulnerability characteristics. Using pre-trained language models (such as CodeT5) combined with fine-tuning can improve the classification of software vulnerability types. However, due to the maximum input length limit of pre-trained language models, previous vulnerability classification methods often need to truncate long text inputs containing more complete and comprehensive vulnerability information. This can easily lead to the loss of key information and affect the model's classification accuracy.

[0005] How to solve the above technical problems becomes the subject faced by the present invention. Summary of the Invention

[0006] The purpose of the present invention is to provide a multimodal long text vulnerability classification method based on transfer learning and loss adjustment, which can more effectively classify software vulnerabilities.

[0007] The idea of the present invention is as follows: The present invention proposes a multimodal long-text vulnerability classification method based on transfer learning and loss adjustment. This method combines transfer learning with long-tail learning, fusing vulnerability descriptions and source code into long-text inputs. At the same time, a sliding window segmentation fusion method is designed so that bimodal information can be fully input into the pre-trained language model, ensuring the integrity of vulnerability information and improving classification performance. An adaptive loss adjustment mechanism is designed in the method. This mechanism dynamically adjusts the weights of the two loss functions based on the training rounds, so that the model has different learning biases for the head and tail classes at different training stages, thereby alleviating the impact of the long-tail problem.

[0008] The present invention is achieved by the following measures: a multimodal long text vulnerability classification method based on transfer learning and loss adjustment, which includes the following steps:

[0009] 1.1: Preprocess the initial dataset to extract vulnerability descriptions and source code information. Define head and tail class types based on the number of vulnerability types, and convert vulnerability severity into a level label that complies with the CVSS v3 standard.

[0010] 1.2: Using the stratified sampling method, the dataset is divided into non-overlapping training set, validation set and test set with a ratio of 8:1:1;

[0011] 1.3: Combine the vulnerability description and source code into a multimodal long text input, and design a sliding window segmentation fusion method to process the long text and extract the complete context representation;

[0012] 1.4: Fine-tune the pre-trained language model CodeT5 to complete the vulnerability assessment task, and use the early stopping strategy to prevent overfitting and obtain the optimal parameters;

[0013] 1.5: Using the model encoder pre-trained in the vulnerability assessment task, we use a staged unfreezing transfer fine-tuning method to transfer its semantic representation capabilities to the vulnerability type classification task, thereby improving classification accuracy and training efficiency;

[0014] 1.6: Design a dynamic loss function adjustment mechanism to adjust the weights of the composite loss function structure according to the training stage, solving the long-tail problem in the vulnerability classification task;

[0015] 1.7: Use the trained model to input the test set data into the model for vulnerability classification prediction.

[0016] Furthermore, the step 1.1 specifically includes the following steps:

[0017] 2.1: Simplify the source code in the dataset, delete redundant information such as blank lines, leading spaces, and comments in the source code, and while preserving the code logic, make the code information more completely represent the vulnerability characteristics;

[0018] 2.2: Optimize the vulnerability types in the dataset. According to the information on the CWE official website, there are some vulnerability types in the original dataset that have been deprecated by the official website. Now, update or delete these vulnerability entries to make the dataset suitable for the software vulnerability classification task;

[0019] 2.3: Optimize the severity levels of the vulnerabilities in the dataset. The severity scores of the vulnerabilities in the original dataset do not fully conform to the CVSS v3 standard. Now, capture the corresponding score data under the CVSS v3 standard to construct a vulnerability assessment dataset that conforms to the CVSS v3 standard;

[0020] 2.4: Extract information, organize the preprocessed dataset into the format of <CVE ID, code before repair, vulnerability description, vulnerability severity level, vulnerability type> to form the optimized dataset D;

[0021] 2.5: Sort according to the number of each vulnerability type. Define the types with more than 400 vulnerabilities as the head category, and define the others as the tail category. At the same time, group the types with a sample size less than 70 into a new type called "remaining".

[0022] Furthermore, in step 1.3, it specifically includes the following steps:

[0023] 3.1: Concatenate the vulnerability description and the vulnerability source code in a fixed order to form a bimodal long text input sequence. To distinguish different modal information, add <mod-desc>Modal identifier, add before the source code part <mod-code>Modal identifier, the final constructed prompt template format is:

[0024] <mod-desc>Vulnerability description text <mod-code>Source code text;

[0025] 3.2: Slice the concatenated long text using a sliding window with a fixed sliding window length of W = 384 and a sliding step size of S = 192, i.e., a 50% overlap to ensure semantic redundancy and contextual continuity between windows.

[0026] 3.3: Input each input segment Si separately into the encoder of CodeT5 to obtain the context vector representation ri of each segment;

[0027] 3.4: Use weighted average fusion as the representation fusion module to represent all fragments {r1,r2,...,r n } Input fusion module, the final output is the sample-level global representation vector r final , for use by downstream tasks.

[0028] Furthermore, the step 1.4 specifically includes the following steps:

[0029] 4.1: Use the severity scores under the CVSS v3 standard (low, medium, high, and critical) as labels and use the sliding window segment fusion method to extract the global context representation as the input of the model;

[0030] 4.2: Fine-tune the model for multiple rounds of training. After each round, evaluate the model performance on the validation set. If the validation set performance does not improve after N = 10 consecutive rounds, trigger the early stopping mechanism to prevent overfitting.

[0031] 4.3: After the training is completed, save the encoder parameter weights as the initialization parameters for transfer learning in the subsequent target task (vulnerability type classification).

[0032] Furthermore, the step 1.5 specifically includes the following steps:

[0033] 5.1: Load the encoder weights obtained from the vulnerability assessment task and use them as initialization parameters for the target task;

[0034] 5.2: Build the target task model, retain the original encoder structure, and reinitialize the classifier head to adapt to the vulnerability type label;

[0035] 5.3: In the initial stage, the encoder parameters are frozen and only the classifier head is trained to ensure that the transferred features are not destroyed;

[0036] 5.4: During the training process, the last few layers of the encoder are gradually unfrozen to make the model gradually adapt to the vulnerability type classification task;

[0037] 5.5: Validate on the validation set, use the adaptive dynamic loss function to calculate the error, and optimize the model performance.

[0038] Furthermore, the step 1.6 specifically includes the following steps:

[0039] 6.1: Use two basic loss functions: focal loss function and label smoothed cross entropy loss function, defined as follows:

[0040] Focal Loss:

[0041]

[0042] Where C is the total number of categories, γ is the focusing parameter, and p i is the predicted probability of the i-th category, y i is one-hot encoding, the label value of the i-th category;

[0043] Label smoothed cross entropy loss function (LSCE):

[0044]

[0045] Where ∈ is the label smoothing factor;

[0046] 6.2: Construct a composite loss function structure, fuse the focal loss and label smoothed cross entropy loss proportionally and weightedly, and construct a unified training objective function with the following structure:

[0047]

[0048] Where T(t) is the scheduling coefficient that changes with the training round and is defined as follows:

[0049] T(t)=1-(E now / E max ) 2

[0050] Where Enow represents the current number of training rounds, and Emax is the preset maximum number of training rounds.

[0051] In step 1.7, the trained vulnerability classification model is used to input the data of the test set into the model for prediction, and the final classification result is output.

[0052] Compared with the prior art, the present invention has the following beneficial effects:

[0053] 1. This paper proposes a multimodal long-text vulnerability classification method based on transfer learning and loss adjustment. This method mitigates the long-tail problem in vulnerability classification datasets by designing an adaptive loss function adjustment mechanism. This method fuses vulnerability descriptions and source code into a long-text input. A sliding window segmentation fusion method is also employed to fully input the bimodal information into a pre-trained language model, ensuring the integrity of vulnerability information and improving the model's software vulnerability classification performance.

[0054] 2. This invention introduces transfer learning, leveraging the strong correlation between vulnerability classification and vulnerability assessment. Research has found that some vulnerability types are generally more severe than others. Furthermore, vulnerability classification often faces the challenge of insufficient labeled data, especially for rare or complex vulnerability types. In contrast, vulnerability severity assessment typically has more abundant labeled data. Transfer learning leverages the knowledge learned from the assessment task to improve the performance and efficiency of the classification task.

[0055] 3. The present invention introduces long-tail learning and designs an adaptive loss function adjustment mechanism to alleviate the long-tail problem in vulnerability classification datasets. The efficiency of software vulnerability type classification tasks is significantly affected by the long-tail problem, and previous research models rarely fully consider this issue. The adaptive loss function adjustment mechanism designed in this method cleverly utilizes the different learning emphases of the two loss functions for the head and tail classes during training, and dynamically adjusts the weights of the two loss functions during training, so that the model has different learning biases for the head and tail classes at different training stages, thereby alleviating the impact of the long-tail problem and improving classification performance.

[0056] 4. This invention uses bimodal information fusion. Current vulnerability type classification research usually relies on a single type of vulnerability information for classification. However, this method combines bimodal information of source code and vulnerability description, and a richer vulnerability feature input model, which significantly improves the performance of software vulnerability classification.

[0057] 5. This paper designs a sliding window segmented fusion method to solve the problem of truncating overlong samples and losing key information when processing long text inputs due to the maximum input length limit of pre-trained language models. Because this method uses bimodal information for input, analysis found that most inputs in the dataset exceed the maximum input length limit. Therefore, the sliding window segmented fusion method retains more information, allowing the model to learn richer vulnerability characteristics and improve the model's classification accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention.

[0059] Figure 1 This is a system framework diagram of the multimodal long text vulnerability classification method based on transfer learning and loss adjustment provided by the present invention. DETAILED DESCRIPTION

[0060] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. Of course, the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0061] Example 1

[0062] See also Figure 1 As shown, this embodiment provides a multimodal long text vulnerability classification method based on transfer learning and loss adjustment, which specifically includes the following contents:

[0063] (1-1) Preprocess the initial dataset, extract vulnerability descriptions and source code information, define head and tail types according to the number of vulnerability types, and convert vulnerability severity into a level label that complies with the CVSS v3 standard;

[0064] (1-2) Using a stratified sampling method, the dataset was divided into non-overlapping training, validation, and test sets with a ratio of 8:1:1;

[0065] (1-3) Concatenate the vulnerability description and source code into a multimodal long text input, and design a sliding window segmentation fusion method to process the long text and extract the complete context representation;

[0066] (1-4) Fine-tune the pre-trained language model CodeT5 to complete the vulnerability assessment task, and use the early stopping strategy to prevent overfitting and obtain the optimal parameters;

[0067] (1-5) Using the model encoder pre-trained in the vulnerability assessment task, a staged unfreezing transfer fine-tuning method is used to transfer its semantic representation capabilities to the vulnerability type classification task, thereby improving classification accuracy and training efficiency;

[0068] (1-6) Design a dynamic loss function adjustment mechanism to adjust the weights of the composite loss function structure according to the training stage, solving the long-tail problem in the vulnerability classification task;

[0069] (1-7) Use the trained model and input the test set data into the model to perform vulnerability classification prediction.

[0070] Further, in the step (1-1), it specifically includes the following steps:

[0071] (2-1) Simplify the source code in the dataset, delete redundant information such as blank lines, leading spaces, and comments in the source code, and while preserving the code logic, make the code information more completely represent the vulnerability characteristics;

[0072] (2-2) Optimize the vulnerability types in the dataset. According to the information on the CWE official website, there are some vulnerability types in the original dataset that have been deprecated by the official website. Now, update or delete these vulnerability entries to make the dataset suitable for the software vulnerability classification task;

[0073] (2-3) Optimize the severity levels of the vulnerabilities in the dataset. The severity scores of the vulnerabilities in the original dataset do not fully conform to the CVSS v3 standard. Now, capture the corresponding score data under the CVSS v3 standard to construct a vulnerability assessment dataset that conforms to the CVSS v3 standard;

[0074] (2-4) Extract information, organize the preprocessed dataset into the format of <CVE ID, code before repair, vulnerability description, vulnerability severity level, vulnerability type> to form an optimized dataset D;

[0075] (2-5) Sort according to the number of each vulnerability type, define the types with more than 400 vulnerability entries as the head category, define the others as the tail category, and at the same time group the types with a sample size less than 70 into a new type named "remaining".

[0076] Further, in the step (1-3), it specifically includes the following steps:

[0077] (3-1) Concatenate the vulnerability description and the vulnerability source code in a fixed order to form a dual-modal long text input sequence. To distinguish different modal information, add <mod-desc>Modal identifier, add before the source code part <mod-code>Modal identifier, the final constructed prompt template format is:

[0078] <mod-desc>Vulnerability description text <mod-code>Source code text;

[0079] (3-2) Slice the concatenated long text using a sliding window with a fixed sliding window length of W = 384 and a sliding step size of S = 192, i.e., a 50% overlap to ensure semantic redundancy and contextual continuity between windows.

[0080] (3-3) Input each input segment Si into the encoder of CodeT5 separately to obtain the context vector representation ri of each segment;

[0081] (3-4) Use weighted average fusion as the representation fusion module to represent all fragments {r1,r2,...,r n } Input fusion module, the final output is the sample-level global representation vector r final , for use by downstream tasks.

[0082] Furthermore, the steps (1-4) specifically include the following steps:

[0083] (4-1) Using the severity scores (low, medium, high, and severe) under the CVSS v3 standard as labels, and using the sliding window segment fusion method to extract the global context representation as the input of the model;

[0084] (4-2) Fine-tune the model for multiple rounds of training. After each round of training, evaluate the model performance on the validation set. If the validation set performance does not improve after N = 10 consecutive rounds, trigger the early stopping mechanism to prevent overfitting.

[0085] (4-3) After the training is completed, the parameter weights of the encoder are saved as the initialization parameters for transfer learning in the subsequent target task (vulnerability type classification).

[0086] Furthermore, the steps (1-5) specifically include the following steps:

[0087] (5-1) Load the encoder weights obtained from the vulnerability assessment task and use them as initialization parameters for the target task;

[0088] (5-2) Build the target task model, retain the original encoder structure, and reinitialize the classifier head to adapt to the vulnerability type label;

[0089] (5-3) In the initial stage, the encoder parameters are frozen and only the classifier head is trained to ensure that the migration features are not destroyed;

[0090] (5-4) During the training process, the last few layers of the encoder are gradually unfrozen to make the model gradually adapt to the vulnerability type classification task;

[0091] (5-5) Verify on the validation set, use the adaptive dynamic loss function to calculate the error, and optimize the model performance.

[0092] Furthermore, the steps (1-6) specifically include the following steps:

[0093] (6-1) Two basic loss functions are used: focal loss function and label smoothed cross entropy loss function, which are defined as follows:

[0094] Focal Loss:

[0095]

[0096] Where C is the total number of categories, γ is the focusing parameter, and p i is the predicted probability of the i-th category, y i is one-hot encoding, the label value of the i-th category;

[0097] Label smoothed cross entropy loss function (LSCE):

[0098]

[0099] Where ∈ is the label smoothing factor;

[0100] (6-2) Construct a composite loss function structure, fuse the focal loss and label smoothed cross entropy loss in a proportional weighted manner, and construct a unified training objective function with the following structure:

[0101]

[0102] Where T(t) is the scheduling coefficient that changes with the training round and is defined as follows:

[0103] T(t)=1-(E now / E max ) 2

[0104] Where Enow represents the current number of training rounds, and Emax is the preset maximum number of training rounds.

[0105] In the steps (1-7), the trained vulnerability classification model is used to input the data of the test set into the model for prediction, and the final classification result is output.

[0106] (8) The method of this embodiment is compared with existing software vulnerability classification methods on the same dataset, and the quality of the model is automatically evaluated using five performance indicators from the field of software vulnerability classification research (i.e., Accuracy, Precision, Recall, F1-score, and MCC):

[0107] Table 1 Comparison of results of the method of this embodiment and the control method

[0108]

[0109] The experimental results show that the multimodal long text vulnerability classification method based on transfer learning and loss adjustment proposed in this embodiment has achieved significant advantages in the five key performance indicators of Accuracy, Precision, Recall, F1-score and MCC compared with the existing baseline methods, fully demonstrating its superior performance in software vulnerability classification tasks. Specifically, the experimental results are as follows: The method of this embodiment achieved an accuracy of 69.7%, which is 10.7% higher than the best performing baseline model (VulExplainer CodeBERT , 44.6%), a 25.1% improvement; precision increased by 18.1%; recall jumped from 34.9% to 62.0%, a 27.1% improvement; the F1 score increased by 24.7%; and the MCC metric, which offers stronger overall performance, achieved a significant 27.1% improvement. These results demonstrate that the method proposed in this example, while balancing accuracy and stability, more effectively overcomes the performance bottlenecks of traditional models when dealing with complex vulnerability features and data imbalance, demonstrating strong classification capabilities and promising potential for practical application.

[0110] Example 2

[0111] Based on Example 1, the dataset was repartitioned and the method of this example was compared with existing software vulnerability classification methods. Five performance indicators from the field of software vulnerability classification research (i.e., Accuracy, Precision, Recall, F1-score, and MCC) were used to automatically evaluate the quality of the model:

[0112] Table 2 Comparison of results of the method of this embodiment and the control method

[0113]

[0114]

[0115] The experimental results show that the multimodal long text vulnerability classification method based on transfer learning and loss adjustment proposed in this embodiment has achieved significant advantages in the five key performance indicators of Accuracy, Precision, Recall, F1-score and MCC compared with the existing baseline methods, fully demonstrating its superior performance in software vulnerability classification tasks. Specifically, the experimental results are as follows: The method of this embodiment achieved an accuracy of 67.2%, which is 10.3% higher than the best performing baseline model (VulExplainer CodeBERT , 41.6%), a 25.6% improvement; precision increased by 22.3%; recall jumped from 33.3% to 60.6%, a 27.3% improvement; the F1 score increased by 23.7%; and the MCC metric, which offers stronger overall performance, achieved a significant 28.2% improvement. These results demonstrate that the proposed method, while balancing accuracy and stability, more effectively overcomes the performance bottlenecks of traditional models when dealing with complex vulnerability features and data imbalance, demonstrating strong classification capabilities and promising potential for practical application.

[0116] Example 3

[0117] Based on Example 1, the dataset was repartitioned and the method of this example was compared with existing software vulnerability classification methods. Five performance indicators from the field of software vulnerability classification research (i.e., Accuracy, Precision, Recall, F1-score, and MCC) were used to automatically evaluate the quality of the model:

[0118] Table 3 Comparison of results between the method of this embodiment and the control method

[0119]

[0120] The experimental results show that the multimodal long text vulnerability classification method based on transfer learning and loss adjustment proposed in this embodiment has achieved significant advantages in the five key performance indicators of Accuracy, Precision, Recall, F1-score and MCC compared with the existing baseline methods, fully demonstrating its superior performance in software vulnerability classification tasks. Specifically, the experimental results are as follows: The method of this embodiment achieved an accuracy of 66.3%, which is 10.3% higher than the best performing baseline model (VulExplainer CodeBERT , 42.1%), a 24.2% improvement; precision increased by 18.9%; recall jumped from 33.9% to 58.6%, a 24.7% improvement; the F1 score increased by 22.1%; and the MCC metric, which offers stronger overall performance, achieved a significant 26.6% improvement. These results demonstrate that the method proposed in this example, while balancing accuracy and stability, more effectively overcomes the performance bottlenecks of traditional models when dealing with complex vulnerability features and data imbalance, demonstrating strong classification capabilities and promising potential for practical application.

[0121] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A multimodal long text vulnerability classification method based on transfer learning and loss adjustment, characterized by: It includes the following steps: S1: Preprocess the initial dataset, extract vulnerability descriptions and source code information, define the head class type and tail class type according to the number of each vulnerability type, and convert the vulnerability severity into a level label conforming to the CVSS v3 standard; S2: Adopt a stratified sampling method to divide the dataset into non-overlapping training set, validation set and test set, with a ratio of 8:1:1; S3: Concatenate the vulnerability description and the source code into a multi-modal long text input, and design a sliding window segmentation fusion method to process the long text and extract the complete context representation; S4: Fine-tune the pre-trained language model CodeT5 to complete the vulnerability assessment task, and adopt an early stopping strategy to prevent overfitting and obtain the optimal parameters; S5: Use the model encoder pre-trained in the vulnerability assessment task, and use the phased unfreezing transfer fine-tuning method to transfer its semantic representation ability to the vulnerability type classification task; S6: Design a dynamic loss function adjustment mechanism to adjust the weights of the composite loss function structure according to the training stage; S7: Use the trained model to input the data of the test set into the model for vulnerability classification prediction.

2. The multimodal long text vulnerability classification method based on transfer learning and loss adjustment according to claim 1 is characterized in that: The step S1 includes the following steps: S11: Simplify the source code in the dataset, delete the blank lines, leading spaces and comment redundant information in the source code, and while retaining the code logic, make the code information more completely represent the vulnerability characteristics; S12: Optimize the vulnerability types in the dataset. According to the information on the CWE official website, there are some vulnerability types in the original dataset that have been deprecated by the official website. Now update or delete these vulnerability entries to make the dataset suitable for the software vulnerability classification task; S13: Optimize the vulnerability severity in the dataset. Now grab the corresponding score data under the CVSS v3 standard to construct a vulnerability assessment dataset conforming to the CVSS v3 standard; S14: Extract information, organize the preprocessed dataset into the format of <CVE ID, code before repair, vulnerability description, vulnerability severity, vulnerability type> to form an optimized dataset D; S15: Sort according to the number of each vulnerability type, define the types with more than 400 vulnerability numbers as the head class, define the others as the tail class, and group the types with a sample size less than 70 into a new type named "remaining".

3. The multimodal long text vulnerability classification method based on transfer learning and loss adjustment according to claim 1 is characterized in that: The step S3 includes the following steps: S31: Concatenate the vulnerability description and the vulnerability source code in a fixed order to form a bimodal long text input sequence. To distinguish different modal information, add <mod-desc>Modal identifier, add before the source code part <mod-code>Modal identifier, and the finally constructed prompt template format is: <mod-desc>Vulnerability description text <mod-code>Source code text; S32: Slice the concatenated long text, use a sliding window, and set a fixed sliding window length W = 384 and a sliding step S = 192; S33: Input each input segment Si into the encoder of CodeT5 separately to obtain the context vector representation ri of each segment; S34: Use weighted average fusion as the representation fusion module to represent all fragments {r1,r2,...,r n } Input fusion module, the final output is the sample-level global representation vector r final , for use by downstream tasks.

4. The multimodal long text vulnerability classification method based on transfer learning and loss adjustment according to claim 1 is characterized in that: The step S4 includes the following steps: S41: Use the severity scores under the CVSS v3 standard, namely low, medium, high and critical as labels, and use the sliding window segmentation fusion method to extract the global context representation as the input of the model; S42: Fine-tune the model for multiple rounds of training. After each round, evaluate the model performance on the validation set. If the validation set performance does not improve after N = 10 consecutive rounds, trigger the early stopping mechanism to prevent overfitting. S43: After the training is completed, the parameter weights of the encoder are saved as initialization parameters for transfer learning in the subsequent target task vulnerability type classification.

5. The multimodal long text vulnerability classification method based on transfer learning and loss adjustment according to claim 1 is characterized in that: The step S5 comprises the following steps: S51: Load the encoder weights obtained from the vulnerability assessment task and use them as initialization parameters for the target task; S52: Build the target task model, retain the original encoder structure, and reinitialize the classifier head to adapt to the vulnerability type label; S53: In the initial stage, the encoder parameters are frozen and only the classifier head is trained to ensure that the transferred features are not destroyed; S54: During training, the last few layers of the encoder are gradually unfrozen to adapt the model to the vulnerability classification task. S55: Validate on the validation set, use the adaptive dynamic loss function to calculate the error, and optimize the model performance.

6. The multimodal long text vulnerability classification method based on transfer learning and loss adjustment according to claim 1 is characterized in that: The step S6 comprises the following steps: S61: Use two basic loss functions: focal loss function and label smoothed cross entropy loss function, defined as follows: Focal Loss function: Where C is the total number of categories, γ is the focusing parameter, and p i is the predicted probability of the i-th category, y i is one-hot encoding, the label value of the i-th category; Label smoothed cross entropy loss function LSCE: Where ∈ is the label smoothing factor; S62: Construct a composite loss function structure, fuse the focal loss and label smoothed cross entropy loss in a proportional weighted manner, and construct a unified training objective function. The structure is as follows: Where T(t) is the scheduling coefficient that changes with the training round and is defined as follows: T(t)=1-(E now / E max ) 2 Where Enow represents the current number of training rounds, and Emax is the preset maximum number of training rounds.

7. The multimodal long text vulnerability classification method based on transfer learning and loss adjustment according to claim 1 is characterized in that: In step S7, the trained vulnerability classification model is used to input the data of the test set into the model for prediction, and the final classification result is output.

Images