Vulnerability and patch semantic association evaluation method based on graph matching network
By constructing a graph structure and introducing a cross-graph attention mechanism, the problem of low accuracy in existing patch correctness evaluation methods is solved, achieving efficient patch evaluation without program execution, and improving the accuracy and efficiency of automatic program repair.
Patent Information
- Application Number
- CN202511464635.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-10-14
- Publication Date
- 2026-02-06
AI Technical Summary
Existing patch correctness assessment methods have low accuracy in automated program repair. Static methods struggle to capture the semantic alignment between vulnerability reports and patch descriptions, while dynamic methods have high computational overhead and limited applicability.
We employ a graph matching network-based approach. By constructing a graph structure for vulnerability reports and patch descriptions, we introduce a cross-graph attention mechanism for joint semantic modeling and calculate the Euclidean distance between the vulnerability graph and the patch graph to evaluate the correctness of the patch.
It improves the accuracy and applicability of patch evaluation, reduces reliance on program executability, and enhances the efficiency of automatic repair and the quality of software development.
Smart Images
Figure CN121479779A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of program repair technology, and more particularly to a method for evaluating the semantic association between vulnerabilities and patches based on graph matching networks. Background Technology
[0002] In the field of Automated Program Repair (APR), patch correctness assessment is a crucial step in ensuring that patches effectively fix vulnerabilities without introducing new errors. Patch-vulnerability semantic correlation assessment, as an important component, verifies the semantic match between the patch and the vulnerability by analyzing their semantic features, thereby improving patch reliability and remediation effectiveness.
[0003] Existing patch correctness evaluation methods fall into two categories: those based on static feature analysis and those based on dynamic test execution. Static methods, such as Quatrain proposed by Tian et al., utilize natural language processing techniques to transform vulnerability reports and patch descriptions into semantic vectors, calculating similarity to determine patch correctness. This method relies on LSTM or Transformer models, independently modeling vulnerability reports and patch descriptions, concatenating the embedded vectors, and then inputting them into a classifier for prediction. Dynamic methods, such as PATCH-SIM, depend on runtime program behavior, comparing execution trajectories before and after patching to evaluate patch effectiveness. They do not process natural language content, calculating behavioral similarity based on program executability and additional test cases.
[0004] However, existing methods have certain shortcomings. While static methods utilize natural language processing models to encode text, they independently model vulnerability reports and patch descriptions, calculating similarity only in vector space. This makes it difficult to capture the structural and semantic alignment between the two, and they lack effective modeling of the internal syntactic structure and word dependencies. Consequently, similarity calculations are easily affected by word order changes or differences in expression, impacting the accuracy of patch correctness assessment. Dynamic methods, while closer to actual semantics, are highly dependent on the execution environment and additional test samples, resulting in high computational overhead and limited applicability, thus restricting the application of patch correctness assessment methods in a wider range of scenarios. Summary of the Invention
[0005] In view of this, the purpose of this invention is to propose a vulnerability and patch semantic association evaluation method based on graph matching networks to solve the technical problem of low accuracy in patch correctness judgment of existing methods.
[0006] The technical means employed in this invention are as follows: A method for evaluating the semantic association between vulnerabilities and patches based on graph matching networks includes the following steps: S1. Data preprocessing: Standardize vulnerability reports and patch descriptions to obtain preprocessed text; S2. Graph Structure Construction: Using a sliding window mechanism, construct a word co-occurrence graph of the preprocessed text; the nodes of the word co-occurrence graph are words, and the edges of the word co-occurrence graph represent the number of times the words co-occur within the window, generating a vulnerability graph and a patch graph; S3, Graph Embedding Encoding: Word embedding is performed on nodes in the vulnerability graph and patch graph using the GloVe word vector model, and the initial features of nodes and edges in the word co-occurrence graph are encoded into hidden vectors using a multilayer perceptron; S4. Graph Neural Network Propagation and Matching: Information of adjacent nodes in the vulnerability graph and patch graph is aggregated through the graph attention mechanism, so that the representation of each node includes its local context. Through the cross-graph attention mechanism, the node features of the vulnerability graph and patch graph are mutually referenced and aligned in the representation space. S5. Similarity Calculation and Judgment: Using the patch correctness evaluation model, the vulnerability graph and the patch graph are aggregated into graph-level representation vectors respectively, and the Euclidean distance between the vulnerability graph and the patch graph is calculated. If the Euclidean distance similarity is higher than the threshold, it is judged as a correct patch; if the Euclidean distance similarity is lower than the threshold, it is judged as an incorrect patch.
[0007] Furthermore, in S1, the standardization process includes word segmentation, stop word removal, punctuation removal, lowercase conversion, and stemming.
[0008] Furthermore, in S2, a fixed-length sliding window is defined in each preprocessed text segment. This sliding window slides across the text, recording the co-occurrence relationships between all words within the window. In each sliding window, there is an edge connection between any two words, and the edge weight of any two words represents the cumulative frequency of co-occurrence of any two words in the same window.
[0009] Furthermore, in S3: The initial feature vector of a node is obtained through word embedding; the GloVe word vector model is used to assign a vector to each word; for words not included in the word embedding dictionary, a random initialization method is used to generate vectors.
[0010] Furthermore, in S5, the patch correctness evaluation model includes an encoder, a propagation layer, and an aggregator; The encoder initializes the embedding representation for each node and edge in the vulnerability graph or patch graph; the initial feature vector of each node is non-linearly mapped through a multilayer perceptron as the initial hidden state of the node; the weight of each edge in the graph is mapped to an edge embedding vector, as shown in the following formula:
[0011]
[0012] in: Represents a node The original node features, Represents a node Features passed through a multilayer perceptron The initial vector representation after mapping, Represents a set of nodes Map all nodes in the array. Represents a node and The original features of the edges between them Indicates passing through a multilayer perceptron The initial vector representation of the mapped edges, Describe the set of opposite edges Map each edge in the array; The propagation layer achieves iterative updates of node representations through a multi-layer graph matching mechanism. This mechanism includes node interactions within the graph and cross-graph matching between the vulnerability graph and the patch graph. Within the graph, the structural and semantic association strength between nodes is obtained by calculating the attention weights between adjacent nodes, thereby updating the node state. The formula is as follows:
[0013] in: Represents a node arrive The message vector being transmitted and They are the first Round-time node and The representation vector, It is an edge vector. The message function is represented by the current representation of the target node. The neighbor's current expression and the boundary vector between them. As input, the output is a message vector. This indicates that the edges come from two graphs; The aggregator compresses the vectors of all nodes in the entire graph into a unified graph-level vector representation, as shown in the following formula:
[0014] in: Indicates the number of steps in the final round of propagation. Based on the node characteristics of the last round Generate gated scores, and then... The activation function becomes a weight of 0-1. Indicates to Perform an MLP operation, then multiply the results by the gating weights and sum them up. Representation diagram The overall vector, It performs an MLP mapping on the aggregated vectors and finally outputs a graph representation.
[0015] Furthermore, a cross-graph attention mechanism is introduced in the propagation layer, as follows: The cross-graph attention mechanism measures the semantic difference by calculating the matching degree of any pair of nodes in two graphs, and updates the representation of each node accordingly, as shown in the following formula:
[0016] in: Indicates from node To the node Matching information, It is a cross-graph matching function used to output cross-graph information; Calculate attention:
[0017] in: This indicates that the similarity between the vector representations of two nodes is calculated. The function represents an exponential function, and the denominator is... This represents the sum of the exponents of all candidate nodes on the same side, and the output is... This indicates that the nodes in the other graph are... For the nodes of the current graph Attention weights; This means summing the matching vectors from the other graph to obtain a summation with... The relevant overall cross-graph matching representation is equivalent to attention. Multiply by vector difference , represented as That is, the current node representation minus the weighted average representation of the other node; The node after being updated by the propagation layer:
[0018] in: Indicates to Summing the messages from all neighbors yields the aggregated information within the graph. This indicates that the matching vectors from the other graph are summed to obtain cross-graph aggregation information. The node update function represents the current representation. The graph-intra-graph aggregation information and cross-graph aggregation information are used as inputs, and the output is a new vector representation.
[0019] Furthermore, in S5, the formula for calculating the Euclidean distance between the vulnerability graph and the patch graph is as follows:
[0020] in: They are vectors and In the Components of each dimension Two graphs represent vectors. and The Euclidean distance between them.
[0021] The present invention also provides a storage medium comprising a stored program, wherein, when the program is executed, it performs any of the above-described methods for evaluating the semantic association between vulnerabilities and patches based on graph matching networks.
[0022] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes any of the above-described methods for evaluating the semantic association between vulnerabilities and patches based on graph matching networks through the computer program.
[0023] Compared with the prior art, the present invention has the following advantages: This invention effectively identifies patches generated during automated program repair. By constructing a graph structure representation of vulnerability reports and patch descriptions and introducing a cross-graph attention mechanism for joint semantic modeling, this invention effectively solves the problems of missing textual structural information and lack of joint reasoning in existing methods. The main advantages include: avoiding dependence on program executability, improving the applicability and efficiency of patch evaluation; improving the modeling accuracy of semantic matching relationships, which is of great significance for improving the reliability of automated repair results; reducing the burden of manual review, accelerating the defect repair process, and improving software development efficiency and quality.
[0024] This invention can simultaneously consider the structural information and semantic relationships between vulnerability reports and patch descriptions, improving the accuracy and generalization ability of the assessment. This invention transforms natural language text into a graph representation, introduces graph neural networks and cross-graph attention mechanisms, and achieves information interaction and joint modeling at the graph level. This avoids the shortcomings of independent modeling or reliance on the test environment in traditional methods, and can effectively evaluate the correctness of patches without requiring program execution. Attached Figure Description
[0025] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0026] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation
[0027] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.
[0028] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.
[0029] like Figure 1 As shown, this invention provides a method for evaluating the semantic association between vulnerabilities and patches based on graph matching networks. This invention takes vulnerability reports and patch descriptions as input, and after data preprocessing, extracts features from the text and constructs a text graph structure. To comprehensively analyze text features, this invention uses a graph embedding component to encode the text into a feature graph, capturing lexical, syntactic, and key semantic information. During graph construction, a fixed-size sliding window is set, the co-occurrence frequency between word pairs is counted as edge weights, and pre-trained GloVe word vectors are used to assign initial representations to nodes, thereby better capturing semantic cues. In the patch correctness evaluation stage, the Euclidean similarity between two feature graphs is calculated, and a cross-graph attention mechanism is introduced to model inter-graph interactions. This mechanism not only calculates the attention coefficients of adjacent nodes within the graph but also focuses on the attention of nodes between graphs to achieve joint reasoning between vulnerability reports and patch descriptions. Finally, the correctness of the patch is judged by the similarity between graph vectors. Specifically, the following steps are included: S1. Data preprocessing: Standardize vulnerability reports and patch descriptions to obtain preprocessed text; The graph embedding component is responsible for converting text-based vulnerability reports and patch descriptions into a graph structure representation to fully preserve their lexical, syntactic, and semantic features. Due to issues such as diverse lexical forms, inconsistent capitalization, and the presence of stop words and punctuation in the original text, data preprocessing is required first. This process utilizes the NLTK tool to segment the original sentences, removes punctuation and stop words using regular expressions, converts all words to lowercase, and finally normalizes the words to their root forms to eliminate semantic redundancy and formal inconsistencies.
[0030] S2. Graph Structure Construction: Using a sliding window mechanism, a word co-occurrence graph of the preprocessed text is constructed; the nodes of the word co-occurrence graph are words, and the edges of the word co-occurrence graph represent the number of times the words co-occur within the window; In the graph construction phase, a sliding window-based co-occurrence mechanism is used to construct the text graph. In each processed text segment, a fixed-length sliding window (e.g., size 9) is defined. This window slides across the text, recording the co-occurrence relationships between all words within the window. Within each window, any two words are considered to be connected by an edge, and the edge weight represents the cumulative frequency of their co-occurrence within the same window. In this way, an undirected graph is constructed, where nodes represent words and edges represent the contextual relevance between words.
[0031] S3. Graph Embedding Encoding: Using a multilayer perceptron, the initial features of nodes and edges in the word co-occurrence graph are encoded into hidden vectors to generate vulnerability graphs and patch graphs. The initial feature vectors of nodes are obtained through word embedding. This invention uses a pre-trained GloVe word vector model to assign a 300-dimensional vector to each word. For words not included in the word embedding dictionary, the system generates vectors using a random initialization method within the range of -0.01 to 0.01.
[0032] The graph embedding module ultimately generates two graph structures: one corresponding to the vulnerability report and the other to the patch description, providing input for graph matching and cross-graph attention mechanisms in subsequent modules. This design not only preserves the structural and semantic information of the original text but also has the ability to perform deep modeling of the relationships between different texts.
[0033] S4. Graph Neural Network Propagation and Matching: Introducing intra-graph and cross-graph attention mechanisms to aggregate neighbor information within and between the vulnerability graph and patch graph, respectively. S5. Similarity Calculation and Judgment: Using the patch correctness evaluation model, the vulnerability graph and the patch graph are aggregated into graph-level representation vectors respectively, and the Euclidean distance between the vulnerability graph and the patch graph is calculated. If the Euclidean distance similarity is higher than the threshold, it is judged as a correct patch; if the Euclidean distance similarity is lower than the threshold, it is judged as an incorrect patch.
[0034] The core objective of the patch correctness assessment component is to evaluate the semantic matching degree between vulnerability reports and patch descriptions, and thereby determine whether the patch is correct. This module is built upon graph neural networks, further incorporating graph matching and attention mechanisms to enable information exchange and joint reasoning between graphs. It mainly consists of three sub-modules: an encoder, a propagation layer, and an aggregator.
[0035] During the encoder phase, the model first initializes the embedding representation for each node and edge in the graph. For each node, its initial feature vector is non-linearly mapped through a multilayer perceptron to serve as the node's initial hidden state. Similarly, the weight (co-occurrence count) of each edge in the graph is also mapped to an edge embedding vector.
[0036]
[0037]
[0038] The propagation layer achieves iterative updates of node representations through a multi-layer graph matching mechanism, including both intra-graph node interactions and cross-graph matching between the vulnerability graph and the patch graph. Within the graph, attention weights between adjacent nodes are calculated to obtain the strength of structural and semantic associations between nodes, thereby updating the node state. This mechanism can further explore the local structure and dependencies between words within the graph.
[0039]
[0040] Furthermore, a cross-graph attention mechanism is introduced to enable information exchange between two graphs. This mechanism measures the semantic difference by calculating the matching degree (i.e., attention coefficient) of any pair of nodes in the two graphs, and updates the representation of each node accordingly. This "inter-graph reasoning" approach allows the model to extract contextual information from another graph, thereby establishing a semantic alignment relationship between two texts, effectively overcoming the shortcomings of traditional methods where vulnerabilities and patches are modeled separately and do not interact with each other.
[0041]
[0042] Calculate attention:
[0043] The node after being updated by the propagation layer:
[0044] After the node state update is completed at the propagation layer, the aggregator compresses the vectors of all nodes in the entire graph into a unified graph-level vector representation. This process is achieved through gated weighted summation, that is, using a gating function to dynamically adjust the weight of each node in the final representation, effectively filtering redundant or irrelevant information and retaining key semantic content. In this way, the vulnerability graph and the patch graph obtain their respective overall representations.
[0045]
[0046] Finally, the similarity between the two graph vectors is measured by calculating the Euclidean distance. If the similarity is higher than a preset threshold, the patch is considered a high match with the vulnerability report and is thus a "correct patch"; otherwise, it is considered a "wrong patch." This method achieves a quantitative assessment of the semantic consistency between natural language descriptions without relying on program execution.
[0047]
[0048] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.
Claims
1. A method for evaluating the semantic association between vulnerabilities and patches based on graph matching networks, characterized in that, Includes the following steps: S1. Data preprocessing: Standardize vulnerability reports and patch descriptions to obtain preprocessed text; S2. Graph Structure Construction: Using a sliding window mechanism, construct a word co-occurrence graph of the preprocessed text; the nodes of the word co-occurrence graph are words, and the edges of the word co-occurrence graph represent the number of times the words co-occur within the window, generating a vulnerability graph and a patch graph; S3, Graph Embedding Encoding; Word embeddings are performed on nodes in the vulnerability graph and patch graph using the GloVe word vector model, and the initial features of nodes and edges in the word co-occurrence graph are encoded into hidden vectors using a multilayer perceptron. S4. Graph Neural Network Propagation and Matching: Information of adjacent nodes in the vulnerability graph and patch graph is aggregated through the graph attention mechanism, so that the representation of each node includes its local context. Through the cross-graph attention mechanism, the node features of the vulnerability graph and patch graph are mutually referenced and aligned in the representation space. S5. Similarity Calculation and Judgment: Using the patch correctness evaluation model, the vulnerability graph and the patch graph are aggregated into graph-level representation vectors respectively, and the Euclidean distance between the vulnerability graph and the patch graph is calculated. If the Euclidean distance similarity is higher than the threshold, it is judged as a correct patch; if the Euclidean distance similarity is lower than the threshold, it is judged as an incorrect patch.
2. The vulnerability and patch semantic association evaluation method based on graph matching networks according to claim 1, characterized in that, In S1, the standardization process includes word segmentation, stop word removal, punctuation removal, lowercase conversion, and stemming.
3. The vulnerability and patch semantic association evaluation method based on graph matching networks according to claim 1, characterized in that, In S2, a fixed-length sliding window is defined in each preprocessed text segment. This sliding window slides across the text, recording the co-occurrence relationships between all words within the window. In each sliding window, there is an edge connection between any two words, and the edge weight of any two words represents the cumulative frequency of their co-occurrence in the same window.
4. The vulnerability and patch semantic association evaluation method based on graph matching networks according to claim 1, characterized in that, In S3: The initial feature vector of a node is obtained through word embedding; the GloVe word vector model is used to assign a vector to each word; for words not included in the word embedding dictionary, a random initialization method is used to generate vectors.
5. The vulnerability and patch semantic association evaluation method based on graph matching networks according to claim 1, characterized in that, In S5, the patch correctness evaluation model includes an encoder, a propagation layer, and an aggregator; The encoder initializes the embedding representation for each node and edge in the vulnerability graph or patch graph; the initial feature vector of each node is non-linearly mapped through a multilayer perceptron as the initial hidden state of the node; the weight of each edge in the graph is mapped to an edge embedding vector, as shown in the following formula: in: Represents a node The original node features, Represents a node Features passed through a multilayer perceptron The initial vector representation after mapping, Represents a set of nodes Map all nodes in the array. Represents a node and The original features of the edges between them Indicates passing through a multilayer perceptron The initial vector representation of the mapped edges, Describe the set of opposite edges Map each edge in the array; The propagation layer achieves iterative updates of node representations through a multi-layer graph matching mechanism. This mechanism includes node interactions within the graph and cross-graph matching between the vulnerability graph and the patch graph. Within the graph, the structural and semantic association strength between nodes is obtained by calculating the attention weights between adjacent nodes, thereby updating the node state. The formula is as follows: in: Represents a node arrive The message vector being transmitted and They are the first Round-time node and The representation vector, It is an edge vector. The message function is represented by the current representation of the target node. The neighbor's current expression and the boundary vector between them. As input, the output is a message vector. This indicates that the edges come from two graphs; The aggregator compresses the vectors of all nodes in the entire graph into a unified graph-level vector representation, as shown in the following formula: in: Indicates the number of steps in the final round of propagation. Based on the node characteristics of the last round Generate gated scores, and then... The activation function becomes a weight of 0-1. Indicates to Perform an MLP operation, then multiply the results by the gating weights and sum them up. Representation diagram The overall vector, It performs an MLP mapping on the aggregated vectors and finally outputs a graph representation.
6. The vulnerability and patch semantic association evaluation method based on graph matching networks according to claim 5, characterized in that, A cross-graph attention mechanism is introduced in the propagation layer, as follows: The cross-graph attention mechanism measures the semantic difference by calculating the matching degree of any pair of nodes in two graphs, and updates the representation of each node accordingly, as shown in the following formula: in: Indicates from node To the node Matching information, It is a cross-graph matching function used to output cross-graph information; Calculate attention: in: This indicates that the similarity between the vector representations of two nodes is calculated. The function represents an exponential function, and the denominator is... This represents the sum of the exponents of all candidate nodes on the same side, and the output is... This indicates that the nodes in the other graph are... For the nodes of the current graph Attention weights; This means summing the matching vectors from the other graph to obtain a summation with... The relevant overall cross-graph matching representation is equivalent to attention. Multiply by vector difference , represented as That is, the current node representation minus the weighted average representation of the other node; The node after being updated by the propagation layer: in: Indicates to Summing the messages from all neighbors yields the aggregated information within the graph. This indicates that the matching vectors from the other graph are summed to obtain cross-graph aggregation information. The node update function represents the current representation. The graph-intra-graph aggregation information and cross-graph aggregation information are used as inputs, and the output is a new vector representation.
7. The vulnerability and patch semantic association evaluation method based on graph matching networks according to claim 1, characterized in that, In S5, the formula for calculating the Euclidean distance between the vulnerability graph and the patch graph is as follows: in: They are vectors and In the Components of each dimension Two graphs represent vectors. and The Euclidean distance between them.
8. A storage medium, characterized in that, The storage medium includes a stored program, wherein when the program is executed, it performs the vulnerability and patch semantic association evaluation method based on graph matching networks as described in any one of claims 1 to 7.
9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, The processor executes the vulnerability and patch semantic association evaluation method based on graph matching networks as described in any one of claims 1 to 7 through the computer program.