A source code vulnerability detection method based on multi-source feature fusion and ensemble learning

Abstract

The application discloses a source code vulnerability detection method based on multi-source feature fusion and ensemble learning, which adopts a three-stage pipeline architecture: firstly, four-way features of abstract syntax tree, control flow graph, data flow graph and sequential semantics are extracted from the source code in parallel and encoded respectively; secondly, the four-way features are dynamically assigned weights and weightedly fused through a multi-head attention mechanism, and a limited-depth inter-function dependency graph is constructed to complete the inter-process context of cross-function, and then the context-enhanced multi-source fusion vector of 512 dimensions is output through the transformation coding and principal component analysis dimension reduction; finally, the three vulnerability type exclusive sub-models of syntax, data flow and control flow are driven by the fusion vector for parallel integrated detection, the contribution of each sub-model is quantified by combining gradient importance analysis, and the integrated decision layer dynamically weights the output of the detection label, vulnerability confidence and the explainability report containing the main trigger sub-model, key feature dimension and CWE vulnerability type inference.

Description

Technical Field

[0001] This invention belongs to the field of interdisciplinary technology of network security and artificial intelligence, specifically relating to a source code vulnerability detection method and system based on multi-source feature fusion and ensemble learning. Background Technology

[0002] Software security vulnerabilities are a major source of cyberattacks, leading to data breaches, system intrusions, service interruptions, and other security incidents that continue to cause significant social and economic losses. Source code vulnerability detection aims to identify potential security flaws during the development phase before software release and is a key technical means to improve the overall security quality of software.

[0003] Traditional static analysis methods (such as symbolic execution, taint analysis, and pattern matching) can analyze source code without running the program, but they suffer from high false positive rates, high rule maintenance costs, and difficulty in effectively dealing with path explosion problems in complex programs. Dynamic analysis methods (such as fuzzing) rely on the actual execution of the program, have limited coverage, and are unlikely to trigger deep vulnerability paths. In recent years, deep learning methods have shown significant advantages in the field of vulnerability detection due to their powerful automatic feature learning capabilities, becoming a research hotspot. However, existing deep learning vulnerability detection methods still face the following four major technical bottlenecks in engineering practice: First, the reliance on a single code representation dimension leads to a systemic detection blind spot. Existing methods typically use only one code graph representation as a feature source. However, the core triggering mechanisms of different vulnerability types correspond to different code representation dimensions: buffer overflow vulnerabilities (CWE-119) manifest as out-of-bounds array access at the syntax level; null pointer dereference vulnerabilities (CWE-476) manifest as execution branches lacking null pointer checks at the control flow level; and use-after-free vulnerabilities (CWE-416) manifest as variables still being referenced after memory is freed at the data flow level. Methods relying on a single dimension have a systemic detection blind spot for vulnerability types outside their coverage.

[0004] Secondly, the weights of multi-source feature fusion are fixed, lacking adaptive adjustment capabilities. Existing multi-source fusion methods typically use fixed weights for each feature dimension, simply concatenating or averaging them with equal weights. This fails to adaptively adjust the contribution ratio of each dimension based on the actual feature distribution of the current code sample, reducing the model's detection accuracy and generalization ability across vulnerability types.

[0005] Third, it is limited to function-level analysis and lacks the ability to detect vulnerabilities across function procedures. In many real-world vulnerability scenarios, the complete triggering conditions of a vulnerability span multiple function call boundaries. Most existing deep learning methods are limited to single-function-level code analysis and cannot model the data flow transmission relationships and variable dependency chains across function boundaries, resulting in a persistently high false negative rate for inter-procedural vulnerabilities.

[0006] Fourth, the model output lacks interpretability, making it difficult to implement in engineering. Existing methods typically only output a binary judgment of "vulnerable / no vulnerability," which is a typical "black box" output. Developers cannot know the root cause of the vulnerability, the specific code location involved, or the vulnerability category, making it difficult to adopt the detection results and directly guide the remediation work. This seriously restricts the promotion and application of deep learning methods in actual engineering projects.

[0007] In summary, existing methods have significant shortcomings in four dimensions: detection coverage, feature fusion adaptability, inter-process analysis capability, and interpretability. There is an urgent need to propose a new method that can systematically overcome these bottlenecks.

[0008] Wu et al. proposed the VulCNN method (published at ICSE 2022), which utilizes Joern to extract the procedure dependency graph (PDG), calculates three centrality metrics to generate function images, and trains a CNN model to achieve vulnerability detection. This method outperforms several baseline methods in both detection accuracy and scanning efficiency (Yueming Wu, Deqing Zou, Shihan Dou, Wei Yang, DuoXu, and Hai Jin. 2022. VulCNN: An Image-inspired Scalable VulnerabilityDetection System. In Proceedings of the 44th International Conference on Software Engineering (ICSE '22). ACM, Pittsburgh, PA, USA, 2365–2376. https: / / doi.org / 10.1145 / 3510003.3510229). However, VulCNN relies solely on the single graph structure of PDG, losing multi-dimensional features such as syntax, control flow, and sequence semantics; the image generation process destroys the semantics of the original graph structure; and the method is limited to function-level analysis, unable to handle gaps between cross-function processes; the output results are only binary labels, lacking interpretability.

[0009] Ni et al. proposed MVulD+ (published in ACM TOSEM, 2025), a method that integrates text, graph, and image modal features. It introduces a local encoder to align modalities at the statement level, significantly outperforming nine baseline methods on multiple real-world vulnerability datasets (Chao Ni, Xin Yin, Xinrui Li, Xiaodan Xu, and Zhi Yu. 2025. AbundantModalities Offer More Nutrients: Multi-Modal-Based Function-level Vulnerability Detection. ACM Transactions on Software Engineering and Methodology. https: / / doi.org / 10.1145 / 3731557). However, MVulD+ uses a fixed-weight concatenation strategy for multimodal features, failing to adaptively adjust the contribution ratio of each modality; it does not independently encode different graph structures such as AST, CFG, and DFG; it also lacks inter-process cross-function analysis capabilities; and it does not provide a structured, interpretable report including vulnerability type inference and key code location.

[0010] The two methods mentioned above have significant shortcomings in three dimensions: multidimensional feature adaptive fusion, lightweight inter-process analysis, and structured interpretable output. This is precisely the technical problem that this invention aims to solve. Summary of the Invention

[0011] The purpose of this invention is to propose a source code vulnerability detection method and system based on multi-source feature fusion and ensemble learning. Addressing the four technical bottlenecks revealed in the background, this invention systematically improves the coverage, accuracy, inter-process analysis capabilities, and interpretability of vulnerability detection through a collaborative design of multi-dimensional parallel feature extraction, vulnerability-aware adaptive fusion, lightweight cross-function context completion, and vulnerability type-specific ensemble detection.

[0012] The present invention is achieved by at least one of the following technical solutions.

[0013] A source code vulnerability detection method based on multi-source feature fusion and ensemble learning includes the following steps: Step 1: After preprocessing the source code, the syntax tree feature vector, control flow graph feature vector, data flow graph feature vector, and sequence semantic feature vector are extracted by the corresponding encoder, and the corresponding four feature vectors are output. Step 2: Dynamically calculate the weights of the four features through a multi-head attention mechanism and fuse them in a weighted manner to construct a depth-limited function dependency graph to complete the inter-function process context. After dimensionality reduction by Transformer encoding and principal component analysis, output the context-enhanced multi-source fusion vector. Step 3: Input the multi-source fusion vector into the three vulnerability type-specific sub-models for parallel detection, combine gradient importance analysis to quantify the contribution of each sub-model, and then perform weighted fusion through the integration decision layer to output the final detection label, vulnerability confidence, and interpretability report.

[0014] Furthermore, the four feature vectors in step 1 are extracted in the following ways: (1) The preprocessed code is parsed into an abstract syntax tree using the Joern parser, and the node information is aggregated from top to bottom using a tree-structured graph neural network to output the syntax structure feature vector. Control flow graph eigenvectors (2) Based on the control flow graph, the nodes are basic blocks of the program, the directed edges represent the control flow transfer direction, the graph attention network is used for message passing, the control flow context information of adjacent basic blocks is aggregated, and the control flow feature vector is output. (3) Based on the data flow graph, nodes represent the definition or use of variables, and directed edges represent the direction of data flow. A gated graph neural network is used to propagate along the direction of data flow in multiple hops and output the feature vector of data flow. (4) After the code is tokenized in a linear execution order, it is input into the pre-trained code language model for context-aware encoding, extracting the global semantic representation vector and outputting the sequence semantic feature vector.

[0015] Furthermore, step 2 specifically includes: (1.1) The four feature vectors are used to form a feature set. The attention score of each feature vector relative to the global feature set is calculated. The dynamic fusion weight of each feature is obtained by Softmax normalization. The adaptive fusion vector is obtained after weighted fusion. (1.2) Construct a function dependency graph downwards along the calling relationship with the objective function as the root node; perform graph convolution aggregation on the function dependency graph to obtain the inter-process context feature vector; (1.3) Transformer fusion encoding and principal component analysis dimensionality reduction: The adaptive fusion vector and the inter-process context feature vector are concatenated and input into the Transformer encoder, and then the final multi-source fusion vector is obtained by principal component analysis dimensionality reduction.

[0016] Furthermore, step 3 specifically includes: (1.1) Input the multi-source fusion vector into three vulnerability type-specific sub-models in parallel, and output the probability of each type of vulnerability respectively: the syntax vulnerability-specific sub-model outputs the probability of syntax vulnerability; the data flow vulnerability-specific sub-model outputs the probability of data flow vulnerability; the control flow vulnerability-specific sub-model outputs the probability of control flow vulnerability; (1.2) Perform gradient importance analysis on the probabilities output by the three vulnerability type-specific sub-models, and calculate the feature contribution of each sub-model to the final prediction result; (1.3) A dynamic weighted integration strategy is adopted to combine the output probabilities of the three vulnerability type-specific sub-models and calculate the overall vulnerability confidence; the final detection label is obtained based on the comparison relationship between the confidence and the detection threshold. (1.4) Generate an interpretability report by combining feature contribution, detection label and vulnerability confidence. The report includes: the name of the main triggering sub-model with the highest contribution, the key feature dimensions that trigger detection and the corresponding code location, and the inferred vulnerability category.

[0017] Furthermore, the weights of the four features are dynamically calculated and weighted by a multi-head attention mechanism, as follows: The four feature vectors are arranged into a feature matrix, and one of them is used as the query end for attention calculation. The global feature matrix composed of the four feature vectors is used as the key and value ends. The dynamic fusion weight of the feature vector of that path relative to the global feature set is calculated. Constraints are applied to the dynamic fusion weight to prevent any single feature from being completely ignored or excessively dominating the fusion result, ensuring that all four features make a substantial contribution to the fusion vector.

[0018] Furthermore, all three vulnerability type-specific sub-models adopt a multilayer perceptron structure; each of the three vulnerability type-specific sub-models is trained independently with hierarchical sampling for its corresponding vulnerability type, and the training data is matched according to the vulnerability type. Type weights are introduced into the loss function so that each sub-model is truly specialized to its target vulnerability category.

[0019] The aforementioned source code vulnerability detection system based on multi-source feature fusion and ensemble learning includes: The feature extraction module is used to preprocess the input source code function, extracting syntax tree feature vectors, control flow graph feature vectors, data flow graph feature vectors, and sequence semantic feature vectors in parallel, and outputting four feature vectors with unified dimensions. The adaptive fusion module is used to perform vulnerability-type-aware dynamic weighted fusion of four feature vectors. It combines the context information between the dependency graphs between limited depth functions to complete the process, and outputs a multi-source fusion vector after fusion encoding by the transformer and dimensionality reduction by principal component analysis. The integrated detection module is used to input multi-source fusion vectors in parallel into three vulnerability type-specific sub-models. After gradient importance analysis to quantify the contribution of each sub-model, and then through dynamic weighted integration decision, it outputs detection labels, vulnerability confidence and interpretability reports.

[0020] Furthermore, the integrated detection module includes: Interpretability analysis unit, according to formula Calculate the gradient feature importance score for each sub-model, where For multi-source fusion vectors, The probability of a vulnerability is used to pinpoint the key feature dimensions and code locations that trigger detection. Integrated decision-making units, according to formula Dynamic weighted integration weight Output the overall confidence level of the vulnerability, derive the detection label based on the threshold, and generate an interpretable report that includes the main triggering sub-model, key feature dimensions, and vulnerability category inferences.

[0021] A computer device according to the present invention includes a memory and a processor, the memory being electrically connected to the processor, the memory storing a computer program, which, when executed by the processor, causes the processor to implement the method described herein.

[0022] The present invention provides a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor implements the method described herein.

[0023] Compared with the prior art, the present invention can achieve at least the following beneficial effects: This invention addresses the problem of systematic detection blind spots caused by existing deep learning vulnerability detection methods relying on a single code representation dimension. It achieves full-dimensional coverage of the source code vulnerability feature space across the syntax, control, data, and semantic layers through parallel feature extraction using syntax trees, control flow graphs, data flow graphs, and sequence semantics. This fundamentally eliminates the detection blind spots caused by single feature representations and significantly improves the detection coverage of different vulnerability types. Secondly, addressing the issue of fixed weights and lack of adaptive adjustment in existing multi-source fusion methods, this invention employs a multi-head attention dynamic weight mechanism to adaptively adjust the fusion contribution ratio of each feature based on the distribution of vulnerability features in the input code in real time. Compared to fixed-weight fusion methods, this results in higher detection accuracy. Third, addressing the limitations of existing methods, which are limited to function-level analysis and have high false negative rates for inter-procedural vulnerabilities, this method significantly reduces the false negative rate for cross-function vulnerabilities by using a depth-limited inter-function dependency graph, while keeping the complexity of inter-procedural analysis within an acceptable range. Fourth, addressing the issues of black-box output and difficulty in engineering implementation of existing methods, this method upgrades the detection conclusions from binary judgments to a structured analysis report that includes the main triggering sub-models, key feature dimensions and code locations, and vulnerability category inferences through an interpretability module based on gradient importance. This enables developers to directly understand the causes of vulnerabilities, locate problematic code, and implement targeted remediation, greatly improving the engineering credibility and practical applicability of the detection results. Attached Figure Description

[0024] Figure 1 This is a flowchart illustrating the overall process of the source code vulnerability detection method based on multi-source feature fusion and ensemble learning in this embodiment of the invention. Figure 2 This is a structural diagram of the multi-source feature fusion and adaptive weight calculation module in an embodiment of the present invention.

[0025] Figure 3 This is a flowchart of the integrated detection and interpretability report generation module in an embodiment of the present invention. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0027] like Figures 1-3As shown, this embodiment proposes a source code vulnerability detection method based on multi-source feature fusion and ensemble learning, realizing automated static vulnerability detection and interpretability analysis of source code written in languages ​​such as C / C++. First, a unified preprocessing is performed on the input source code functions, and four feature extraction modules are launched in parallel to extract feature vectors from four dimensions: Abstract Syntax Tree (AST), Control Flow Graph (CFG), Data Flow Graph (DFG), and Sequence Semantics (SEQ). Second, a dynamic weighted fusion for vulnerability type awareness is performed through a multi-head attention mechanism. Next, a depth-limited inter-function dependency graph is constructed to complete the inter-function context information, followed by deep modeling with a Transformer encoder and dimensionality reduction using principal component analysis, outputting a 512-dimensional multi-source fusion vector. Then, the multi-source fusion vector is input in parallel into three vulnerability type-specific sub-models, and after gradient importance analysis and dynamic weighted ensemble decision-making, the final detection conclusion is output. Finally, a structured interpretability report fully presents the detection process and its basis, forming a complete closed loop from source code input to interpretable detection report output.

[0028] Specifically, a source code vulnerability detection method based on multi-source feature fusion and ensemble learning includes the following steps: Step 1: Multidimensional code feature extraction and encoding.

[0029] This step aims to achieve full-dimensional coverage of the source code vulnerability feature space through preprocessing and multi-path parallel feature extraction. It outputs standardized, structured four-path feature vectors as the input basis for the subsequent adaptive fusion module. The specific implementation consists of two sub-stages: code preprocessing and standardization, and four-path parallel feature extraction and encoding.

[0030] (1) Code preprocessing and standardization.

[0031] The preprocessing stage is responsible for cleaning and standardizing the original source code. All preprocessing operations are based on the principle of not destroying the syntactic and semantic information related to vulnerability triggering, ensuring that the code input entering the feature extraction module has a consistent structural representation.

[0032] Preprocessing operations specifically include: (1) Code comment removal: Delete all single-line and multi-line comments in the source code to prevent the comment text from interfering with the subsequent feature extraction process.

[0033] For example, deleting all single-line comments ( / / ) and multi-line comments ( / ) in the source code. … / ), to prevent the annotation text from interfering with the subsequent learning process of lexical features and graph structure.

[0034] (2) Implement identifier standardization, uniformly replacing user-defined variable names, function names, structure names, and other identifiers with standardized placeholders: variable names are replaced with VAR_0, VAR_1, etc., in the order of appearance, and function names are replaced with FUNC_0, FUNC_1, etc., thereby eliminating the interference of naming style differences between different code libraries on the model's cross-library generalization ability. At the same time, type keywords (such as int, char, void, struct, etc.), operators, and pointer operators are retained. Syntax elements directly related to the causes of vulnerabilities, such as , &, and array access operators ([]), are used to ensure that key characteristic information of vulnerability types that are triggered by memory operation semantics, such as buffer overflow and out-of-bounds write, are not lost due to standardized operations.

[0035] (3) Finally, standardize the format, including indentation rules, whitespace handling, and line break formatting, and output standardized code. It serves as the unified input for the four-way feature extraction modules.

[0036] (2) Four-way parallel feature extraction and encoding.

[0037] With standardized code As input, four feature extraction modules are launched in parallel, extracting features from four dimensions: abstract syntax tree, control flow graph, data flow graph, and code sequence. Each module runs independently and is not dependent on the others, with each module outputting its own dimension. (Default 512-dimensional) feature vectors.

[0038] Abstract Syntax Tree Feature Extraction and Encoding: Utilizing Static Analysis Tools for Standardized Code The process involves parsing to generate an abstract syntax tree (AST). The AST precisely depicts the complete syntactic structure of the source code using a tree-like structure. Internal nodes represent syntactic rules (including binary expression nodes, function call nodes, array access nodes, pointer dereference nodes, etc.), while leaf nodes represent specific lexical tags (variable identifiers, constant values, operators, etc.). The type label of each node is mapped to a fixed-dimensional embedding vector. A tree-structured graph neural network (Tree-GNN) is used to perform top-down hierarchical information aggregation on the abstract syntax tree. For non-leaf nodes in the tree... 1. Its hidden representation is updated by aggregating information from all its child nodes:

[0039] in, For nodes The aggregated hidden state representation vector; It is a linear rectification activation function; For nodes Type label embedding vector; For nodes A child node; child node The hidden state representation vector; For learnable weight matrix, For bias vectors, For nodes The set of child nodes. The structural features of the entire syntax tree are aggregated at the root node, outputting the syntax tree feature vector. :

[0040] in, The hidden state vector of the root node of the abstract syntax tree after hierarchical information aggregation represents the aggregated representation of the structural features of the entire syntax tree; The dimension is A real vector space (default 512 dimensions).

[0041] Abstract syntax tree features contribute most strongly to the identification of syntax structure vulnerabilities (buffer overflow type CWE-119, out-of-bounds write type CWE-787), and can effectively capture syntax-level vulnerability patterns such as out-of-bounds array access and illegal memory operations.

[0042] Control flow graph feature extraction and encoding: From Extracting the control flow graph , where the set of nodes Each node A set of edges represents a basic block of the program. The directed edges in the middle represent the possible transfer directions of the control flow (true / false outgoing edges of conditional branches, loop back edges, and jump edges of exception handling paths, etc.), and completely describe the set of all possible execution paths that the program may experience during runtime.

[0043] The entire sentence content of each basic block is embedded into words and then averaged to obtain the initial block-level feature vector. A graph attention network (GAT) is used for multi-round message passing. The node representation update in the l-th round is as follows:

[0044]

[0045] in, For basic block nodes in the control flow graph In the The hidden state vector after round-robin message passing; Neighboring nodes In the The hidden state vector of the wheel; To traverse neighbor nodes in the normalized denominator In the The hidden state vector of the wheel; For nodes The set of neighboring nodes in the control flow graph; For the first Nodes in round-robin message passing For neighboring nodes Attention weight coefficient; For the first The learnable linear transformation matrix of the layer; It is a linear rectification activation function with leakage; A learnable attention vector; This represents a vector concatenation operation; It is a non-linear activation function.

[0046] through After round-robin message passing, global mean pooling is performed on the representations of all nodes in the entire graph, and the control flow feature vector is output. :

[0047] in, To control the set of all basic block nodes in the flow graph, The total number of nodes; The dimension is A real vector space (default 512 dimensions).

[0048] Control flow graph features are most effective in identifying control logic vulnerabilities (null pointer dereferencing CWE-476 and double release CWE-415), and can accurately capture control logic defects such as missing null pointer judgment branches and incorrect handling of abnormal execution paths.

[0049] Data Flow Graph Feature Extraction and Encoding: From Extracting data flow graphs , where nodes A directed edge represents a single definition or usage operation of a variable. Representing data from the definition point Flow to the point of use The path of 3 fully depicts the transit link and cross-statement dependencies of each variable from its definition to its use.

[0050] After embedding each variable operation node, a gated graph neural network (GGNN) is used for multi-hop message propagation along the data flow direction. The GGNN uses a gated recurrent unit (GRU) to control information updates.

[0051]

[0052] in, For variable operation nodes in the data flow graph In the The hidden state vector after round message passing is given by The gating mechanism is updated by combining historical states with current neighbor aggregated messages; A learnable message passing weight matrix. For nodes In the Aggregate neighbor messages received in round, For nodes The upstream definition point node; For nodes In the The hidden state vector of the round; the GRU gating mechanism allows nodes to selectively retain historical states while receiving information from new neighbors, effectively capturing long-chain data dependencies of variables across statements and basic blocks. After global summation and pooling, the output data flow feature vector is obtained. :

[0053] Data flow graph features are most effective in identifying data dependency vulnerabilities (use-after-free vulnerabilities CWE-416 and integer overflow vulnerabilities CWE-190), as they can trace the complete data transfer chain of memory allocation-release-use operations and identify defects such as dangling pointer references.

[0054] Sequence semantic feature extraction and encoding: Tokenization is performed in a linear execution order to obtain a code token sequence. ,in For sequence length, For the first in the sequence Each token is a lexical tag unit at the end of the sequence. After mapping each token to a word embedding vector, it is input into a pre-trained code language model (such as CodeBERT) for bidirectional context-aware encoding. The bidirectional Transformer encoder of the pre-trained model encodes each position in the sequence... Output context-aware hidden state :

[0055] in, The word embedding matrix for each tag in the code tag sequence; This is the position encoding matrix; Indicates that the sequence length is The hidden dimension for each position is A two-dimensional real matrix space.

[0056] Take the hidden state corresponding to the first special marker [CLS] of the sequence as the global semantic representation, and output the sequence semantic feature vector. :

[0057] in, The hidden state vector corresponding to the first special marker [CLS] of the sequence is used as the global semantic representation, with dimension [ ]. (512 dimensions by default).

[0058] Sequence semantic features cover the blind spots of graph structure features at the linear semantic level, fully leveraging the semantic knowledge accumulated by pre-trained models on large-scale code corpora. They exhibit a significant advantage in detecting vulnerabilities related to the order of application interface calls, complementing the advantages of three-way graph structure features. Together, these four features constitute a comprehensive vulnerability feature space. It provides full-dimensional coverage without blind spots.

[0059] Step 2: Adaptive feature fusion for vulnerability type awareness.

[0060] This step takes the four feature vectors output from step 1 as input and introduces a multi-head attention mechanism to dynamically calculate the fusion weights of each feature vector, replacing the static strategy of fixed weight fusion in existing methods, and outputting an adaptive weighted fusion vector. .

[0061] Arrange the four feature vectors output from step 1 into a feature matrix. For the first Road feature vector Using it as the query endpoint for attention calculation, Simultaneously serving as both the key and value ends, the dynamic fusion weights of this feature vector relative to the global feature set are calculated. :

[0062] The attention score is calculated as follows:

[0063] in, This is a scaled dot product attention function; (Query, query matrix) is the feature vector of the current path. Linear projection; (Key, key matrix) and (Value, value matrix) are all global feature matrices. The linear projection of; where Let be the dimension of the key vector. This is a scaling factor to prevent the gradient from vanishing due to excessively large dot product values. Apply constraints This prevents any single feature from being completely ignored or excessively dominating the fusion result, ensuring that all four features make a substantial contribution to the fusion vector.

[0064] The above single-head attention weight calculation process (i.e., for the first...) Road feature vector by Simultaneously serving as both the key and value ends, the dynamic fusion weights of this feature relative to the global feature set are calculated using a scaled dot product attention function. and impose constraints The complete computational process) extends in parallel to =8 attention heads, each head independently calculates the interrelationships of features in different projection subspaces:

[0065]

[0066] in, For the first The output vector of the attention head represents the nth attention head in this subspace. Attention-weighted results of path features relative to the global feature set; For the first The projection matrix of each attention head. The output projection matrix is ​​obtained. Based on the dynamic fusion weights of each feature, the four feature vectors are weighted and linearly fused. The sum of the weights satisfies the normalization constraint, resulting in an adaptive fusion vector. :

[0067] The above mechanism enables the fusion vector to adaptively adjust in real time according to the vulnerability feature distribution of the current code sample: for syntax structure-type vulnerability samples, Automatically assign a higher weight (approximately 0.38) to data-dependent vulnerability samples. Automatically assigning higher weights (approximately 0.40) fundamentally solves the problem of fixed-weight fusion failing to adaptively adjust. (Among them, The dynamic fusion weights for the feature paths of the syntax tree; These are the dynamic fusion weights for the feature paths in the data flow graph; both are calculated in real-time by a multi-head attention mechanism for the current input sample. Step 3: Constructing a depth-limited function dependency graph and completing inter-procedural context.

[0068] This step takes the source code structure information output from step 1 and the adaptive fusion vector output from step 2 as input, designs a lightweight inter-function dependency graph, and accurately completes the missing cross-function call context information of the target function under the condition of limited analysis depth, outputting a global context feature vector. .

[0069] With target detection function Starting with the root node, the analysis proceeds layer by layer downwards along the function call relationships, with the upper limit of analysis depth set to no more than 3 levels, constructing a dependency graph between functions. Formal definition:

[0070] Among them, the node set middle For target detection function, to To call the relevant functions analyzed on the chain; a set of directed edges. Record function for each edge Passed to Key variable set (Including input parameters, return values, and globally shared variables) and their data flow direction; For the actual unfolding depth, in one embodiment, the following is satisfied: .

[0071] For each node in the graph The adaptive fusion vector output in step 2 is used as the initialization source for its node features. If... For the objective function The The layer is called by a function, and its initial characteristics are represented as follows: ,in For the called function The source code is used to obtain an adaptive fusion vector after feature extraction in step 1 and adaptive fusion in step 2. A graph convolutional network (GCN) is employed to perform multi-round neighborhood aggregation, fusing the key variable states and call context information across functions into the feature representation of the target function.

[0072] in, For nodes Dependency graph between functions The set of direct neighbor functions in the middle, and For the first The learnable weight matrix and bias vector of each round. After convolutional aggregation of the two round graphs, the root node of the objective function is obtained. The final hidden state is used as the global context feature vector. :

[0073] in, The root node of the target detection function The final hidden state vector, after being aggregated through two rounds of graph convolution, incorporates cross-function context information from each called function in the call chain, and has a dimension of [missing information]. (512 dimensions by default).

[0074] When the called function is an external library function (such as the standard library's memory allocation `malloc`, memory deallocation `free`, and copy function `memcpy`), its data flow side effects are pre-defined based on the function semantics to ensure complete coverage of inter-procedural vulnerability scenarios involving standard library operations (such as memory allocation and deallocation chains). The analysis depth is capped at 3 layers, and research shows that approximately... The above vulnerability triggering scenarios involve cross-function call depths of no more than 3 levels. This setting effectively covers the vast majority of inter-procedural vulnerability scenarios while effectively avoiding the path explosion problem caused by full inter-procedural analysis.

[0075] Step 4: Transformer fusion encoding and principal component analysis dimensionality reduction.

[0076] This step will use the adaptive fusion vector output from step 2. Compared with the global context feature vector output in step 3 After integration, the data is deeply modeled using a Transformer encoder (a Transformer structure containing only the encoder part, consisting of stacked multi-head self-attention sublayers and feedforward fully connected sublayers, excluding the decoder part), followed by dimensionality reduction using principal component analysis, outputting a 512-dimensional context-enhanced multi-source fusion vector. This serves as the unified input for the three vulnerability type-specific sub-models in step 5.

[0077] First, the two vectors are concatenated to form a complete pre-fusion feature that simultaneously carries the features of four local codes and contextual information between cross-function processes. :

[0078] The default concatenation dimension is 1024. .Will The input Transformer encoder employs a two-layer stacked structure. Each layer contains a multi-head self-attention sublayer, a feedforward fully connected sublayer, residual connections, and layer normalization. The calculation process of the layer Transformer encoder is as follows:

[0079]

[0080] in, For the first The intermediate output vector of the multi-head self-attention sub-layer after residual connection and layer normalization; For the first The output vector of the fully computed Transformer encoder (including feedforward sublayers, residual connections, and layer normalization) is used as the first... Layer input; For layer normalization, each sample is normalized along the feature dimension to stabilize the training process; It is a multi-head self-attention function that models the dependencies between different positions within the input vector in parallel across multiple subspaces.

[0081] in, It is a feedforward fully connected sublayer. The input vector of the feedforward sub-layer (i.e., the output of the previous sub-layer) ); This is the bias vector for the first fully connected layer; This is the bias vector for the second fully connected layer. For learnable weights, the intermediate dimension is expanded to After encoding by a two-layer transformer, the deep fusion feature vector is obtained. .

[0082] Subsequently Perform principal component analysis (PCA) and select samples with a cumulative variance contribution rate of not less than [value missing]. The principal components compress the feature dimension from 1024 to 512. Let... Given the projection matrix formed by the directions of the first 512 principal components, the dimensionality reduction process is as follows:

[0083] in, The 512-dimensional eigenvectors are obtained after dimensionality reduction by principal component analysis; For the training set The mean vector is obtained. After dimensionality reduction, a random deactivation layer (deactivation rate of 0.3) is added to suppress overfitting, outputting the final 512-dimensional context-enhanced multi-source fusion vector. :

[0084] Right now:

[0085] in, The 512-dimensional eigenvectors after dimensionality reduction by principal component analysis; The inactivation probability of a random inactivation layer; Output the dimension for the target. In one embodiment, , .

[0086] It integrates adaptive fusion information of four code features with inter-function dependent context information, taking into account both information integrity and computational efficiency, and serves as the unified input for the third-stage integrated detection module.

[0087] Step 5: Vulnerability type-specific integrated detection and interpretability output.

[0088] This step uses the 512-dimensional multi-source fusion vector output from step 4. Using this as input, high-precision vulnerability detection is performed through a parallel integration framework of vulnerability type-specific sub-models. Furthermore, through gradient-based interpretability analysis, the detection conclusions are upgraded from binary black-box judgments to structured interpretable analysis reports.

[0089] (1) Parallel detection of vulnerability type-specific sub-models Will The parallel input employs three dedicated sub-models for different vulnerability types, each reasoning independently and without dependency. The syntax-specific sub-model detects buffer overflows and out-of-bounds read / write vulnerabilities; the dataflow-specific sub-model detects uses after deallocation and null pointer dereferencing vulnerabilities; and the control flow-specific sub-model detects double deallocation and integer overflow vulnerabilities. All three sub-models utilize a multilayer perceptron (MLP) network structure (512-dimensional input layer). Hidden layers (Hidden layer → Logistic Regression activated output layer), the hidden layer activation function is ReLU, and the output layer activation function is Sigmoid.

[0090] in, For the first The vulnerability probability output by the vulnerability type-specific sub-model ( ) ; , Sub-models Learnable weight matrices of the first and second hidden layers; , This is the bias vector for the corresponding hidden layer; This is the output layer weight vector; This is the output layer bias scalar.

[0091] Among them, the sub-model dedicated to syntax vulnerabilities It focuses on detecting syntax structure vulnerabilities, such as buffer overflows (CWE-119) and out-of-bounds read / write (CWE-787), and outputs the probability of these vulnerabilities. Data flow-related vulnerability-specific sub-model It focuses on detecting data stream dependency vulnerabilities, such as use-after-free (CWE-416) and null pointer dereference (CWE-476), and outputs the probability of data stream vulnerabilities. Control flow vulnerability-specific sub-model It focuses on detecting control flow logic vulnerabilities, such as double release (CWE-415) and integer overflow (CWE-190), and outputs the probability of control flow vulnerabilities. .

[0092] The model training employs a two-stage strategy: the first stage involves independently pre-training each of the three vulnerability-specific sub-models to ensure full convergence on the corresponding vulnerability type data; the second stage involves fixing the parameters of each specific sub-model and jointly training the fusion encoding unit and the weight coefficients of the integrated decision layer. End-to-end optimization is achieved; training employs an adaptive moment estimation optimizer with weight decay, and five-fold hierarchical cross-validation is used to evaluate model performance.

[0093] The training loss function for each vulnerability type-specific sub-model uses binary cross-entropy with type weights:

[0094] in, For sub-model Training loss; For the first The true label of each sample; For sub-model For the The predicted vulnerability probability value output for each sample; , Sub-models The corresponding positive and negative sample type weight coefficients; This represents the number of training batch samples. The training data for each dedicated sub-model is stratified by vulnerability type and trained independently on its respective dedicated training set for the corresponding vulnerability type. Each hidden layer is supplemented with a batch normalization (BatchNorm) layer to accelerate the acquisition, and a random deactivation layer (deactivation rate of 0.3) is added after each hidden layer to prevent overfitting.

[0095] (2) Gradient-based importance analysis and feature localization Gradient-based importance analysis is used to calculate the output probability of each sub-model relative to the input fusion vector. The absolute values ​​of the gradients in each dimension yield the feature importance vectors of each sub-model, quantifying the contribution of each sub-model to the current detection result.

[0096] in, For sub-model Multi-source fusion vector Feature importance vectors for each dimension, where the first element in the vector is... Each component represents No. 3D feature pair model The degree of influence of the output probability; For sub-model The output is the predicted probability value of the vulnerability.

[0097] Taking the absolute value of the gradient makes the importance quantification result independent of the gradient direction, and only reflects the strength of the influence of the corresponding feature dimension on the output probability of the sub-model, thus objectively quantifying the contribution of each dimension.

[0098] Further define the sub-model level contribution score, and obtain the scalar contribution score by summing the importance of each dimension:

[0099] Combined fusion vector Each dimension and the original four-way feature vector ( By establishing the correspondence between the feature dimensions and source code nodes or statements, the system can trace back and locate the key feature dimensions that trigger the detection and judgment. Then, by combining the mapping relationship between the feature dimensions and source code nodes or statements, the system can further locate the specific line number or code range, providing developers with precise guidance on the location of the problematic code.

[0100] (3) Dynamic weighted integrated decision Based on the historical classification accuracy of each specific sub-model on the validation set Dynamically determine integration weights :

[0101] in, For sub-model Historical classification accuracy on the validation set; To traverse all sub-models The summation of the historical accuracy of each sub-model is used for normalization to ensure that the sum of all ensemble weights is 1.

[0102] Sub-models with higher detection performance receive larger ensemble weights, tilting the ensemble decision towards more reliable sub-models. The overall vulnerability confidence is calculated by combining the independent detection probabilities of the three dedicated sub-models and weighting them using dynamic ensemble weights. :

[0103] The final binary detection label is derived based on the comparison between the overall confidence level of the vulnerability and the detection threshold \theta.

[0104] Detection threshold The default setting is 0.5; it can be flexibly adjusted within the range of 0.3 to 0.7 according to the different tolerance requirements for false positive and false negative rates in actual application scenarios—lowering the threshold reduces false positives but increases false positives, and increasing the threshold reduces false positives but increases false negatives. Dynamic weight integration. After system deployment, it can be continuously updated with online verification data accumulated during business operations, enabling the integrated decision-making mechanism to adapt to changes in the distribution ratio of various vulnerability categories under different code repositories and project types, and maintain long-term stable integrated detection performance.

[0105] (4) Generation of structured interpretable reports Combining the feature importance vectors of each sub-model Final test label Label Overall confidence level of vulnerabilities This generates a structured, interpretable report. The report contains the following three core components: Firstly, the main triggering sub-model name, i.e., the contribution score. The largest exclusive sub-model ( or one):

[0106] in, Score based on contribution The largest vulnerability type-specific sub-model index, i.e. the main triggering sub-model that contributes the most to the current detection results; The meaning is the same as the integrated decision part, which is the summation variable of the accuracy of the validation set of each sub-model during traversal normalization.

[0107] Secondly, key feature dimensions and their corresponding code locations, i.e. The system identifies the original feature sources corresponding to the largest values ​​in several dimensions and their corresponding line numbers or code ranges in the source code, enabling developers to quickly locate problematic code. As the main triggering sub-model Multi-source fusion vector Feature importance vectors for each dimension; Through calculation The output probability of the main triggering sub-model is obtained. about Take the absolute value after finding the partial derivative.

[0108] Third, vulnerability category inference, that is, based on The inferred vulnerability category (syntax structure, data flow dependency, or control flow logic) and its corresponding confidence level. This provides developers with clear references to vulnerability types, directly guiding targeted remediation efforts. Among these... The index of the primary triggering sub-model with the highest contribution is determined by... Calculation ; As the main triggering sub-model The confidence level of the output vulnerability type.

[0109] When the detection probabilities of all three sub-models are higher than the detection threshold (Right now When all vulnerabilities are triggered simultaneously, the interpretability report will list all vulnerability categories and their corresponding confidence levels, indicating to developers that the current code segment may involve multiple vulnerability types at the same time, providing a more comprehensive security analysis reference.

[0110] The four feature extraction modules each have a different focus in vulnerability detection: syntax tree features contribute most strongly to the identification of syntax structure vulnerabilities, effectively capturing syntax-level vulnerability patterns such as array out-of-bounds access and illegal memory operations; control flow graph features contribute most strongly to the identification of control logic vulnerabilities, capturing control logic defects such as missing null pointer branches and unhandled abnormal execution paths; data flow graph features contribute most strongly to the identification of data dependency vulnerabilities, tracing the complete data transfer chain of memory allocation, release, and usage operations; sequence semantic features and three-way graph structure features complement each other semantically, jointly covering the full-dimensional feature space of the syntax layer, control layer, data layer, and semantic layer.

[0111] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined in this invention may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A source code vulnerability detection method based on multi-source feature fusion and ensemble learning, characterized in that, Includes the following steps: Step 1: After preprocessing the source code, the syntax tree feature vector, control flow graph feature vector, data flow graph feature vector, and sequence semantic feature vector are extracted by the corresponding encoder, and the corresponding four feature vectors are output. Step 2: Dynamically calculate the weights of the four features through a multi-head attention mechanism and fuse them in a weighted manner to construct a depth-limited function dependency graph to complete the inter-function process context. After dimensionality reduction by Transformer encoding and principal component analysis, output the context-enhanced multi-source fusion vector. Step 3: Input the multi-source fusion vector into the three vulnerability type-specific sub-models for parallel detection, combine gradient importance analysis to quantify the contribution of each sub-model, and then perform weighted fusion through the integration decision layer to output the final detection label, vulnerability confidence, and interpretability report.

2. The source code vulnerability detection method based on multi-source feature fusion and ensemble learning according to claim 1, characterized in that, The four feature vectors in step 1 are extracted in the following ways: (1) The preprocessed code is parsed into an abstract syntax tree using the Joern parser, and the node information is aggregated from top to bottom using a tree-structured graph neural network to output the syntax structure feature vector. Control flow graph eigenvectors (2) Based on the control flow graph, the nodes are basic blocks of the program, the directed edges represent the control flow transfer direction, the graph attention network is used for message passing, the control flow context information of adjacent basic blocks is aggregated, and the control flow feature vector is output. (3) Based on the data flow graph, nodes represent the definition or use of variables, and directed edges represent the direction of data flow. A gated graph neural network is used to propagate along the direction of data flow in multiple hops and output the feature vector of data flow. (4) After the code is tokenized in a linear execution order, it is input into the pre-trained code language model for context-aware encoding, extracting the global semantic representation vector and outputting the sequence semantic feature vector.

3. The source code vulnerability detection method based on multi-source feature fusion and ensemble learning according to claim 1, characterized in that, Step 2 specifically includes: (1.1) The four feature vectors are used to form a feature set. The attention score of each feature vector relative to the global feature set is calculated. The dynamic fusion weight of each feature is obtained by Softmax normalization. The adaptive fusion vector is obtained after weighted fusion. (1.2) Construct a function dependency graph downwards along the calling relationship with the objective function as the root node; perform graph convolution aggregation on the function dependency graph to obtain the inter-process context feature vector; (1.3) Transformer fusion encoding and principal component analysis dimensionality reduction: The adaptive fusion vector and the inter-process context feature vector are concatenated and input into the Transformer encoder, and then the final multi-source fusion vector is obtained by principal component analysis dimensionality reduction.

4. The source code vulnerability detection method based on multi-source feature fusion and ensemble learning according to claim 1, characterized in that, Step 3 specifically includes: (1.1) Input the multi-source fusion vector into three vulnerability type-specific sub-models in parallel, and output the probability of each type of vulnerability respectively: the syntax vulnerability-specific sub-model outputs the probability of syntax vulnerability; the data flow vulnerability-specific sub-model outputs the probability of data flow vulnerability; the control flow vulnerability-specific sub-model outputs the probability of control flow vulnerability; (1.2) Perform gradient importance analysis on the probabilities output by the three vulnerability type-specific sub-models, and calculate the feature contribution of each sub-model to the final prediction result; (1.3) A dynamic weighted integration strategy is adopted to combine the output probabilities of the three vulnerability type-specific sub-models and calculate the overall vulnerability confidence; the final detection label is obtained based on the comparison relationship between the confidence and the detection threshold. (1.4) Generate an interpretability report by combining feature contribution, detection label and vulnerability confidence. The report includes: the name of the main triggering sub-model with the highest contribution, the key feature dimensions that trigger detection and the corresponding code location, and the inferred vulnerability category.

5. The source code vulnerability detection method based on multi-source feature fusion and ensemble learning according to claim 1, characterized in that, The four feature weights are dynamically calculated and weighted fused using a multi-head attention mechanism, as follows: The four feature vectors are arranged into a feature matrix, and one of them is used as the query end for attention calculation. The global feature matrix composed of the four feature vectors is used as the key and value ends. The dynamic fusion weight of the feature vector relative to the global feature set is calculated. Constraints are applied to the dynamic fusion weight to prevent any single feature from being completely ignored or excessively dominating the fusion result, ensuring that all four features make a substantial contribution to the fusion vector.

6. The source code vulnerability detection method based on multi-source feature fusion and ensemble learning according to claim 1, characterized in that, All three vulnerability type-specific sub-models adopt a multilayer perceptron structure. Each of the three vulnerability type-specific sub-models is trained independently with hierarchical sampling for its corresponding vulnerability type. The training data is matched according to the vulnerability type, and type weights are introduced into the loss function so that each sub-model is truly specialized to its target vulnerability category.

7. A source code vulnerability detection system based on multi-source feature fusion and ensemble learning as described in claim 1, characterized in that, include: The feature extraction module is used to preprocess the input source code function, extracting syntax tree feature vectors, control flow graph feature vectors, data flow graph feature vectors, and sequence semantic feature vectors in parallel, and outputting four feature vectors with unified dimensions. The adaptive fusion module is used to perform vulnerability-type-aware dynamic weighted fusion of four feature vectors. It combines the context information between the dependency graphs between limited depth functions to complete the process, and outputs a multi-source fusion vector after fusion encoding by the transformer and dimensionality reduction by principal component analysis. The integrated detection module is used to input multi-source fusion vectors in parallel into three vulnerability type-specific sub-models. After gradient importance analysis to quantify the contribution of each sub-model, and then through dynamic weighted integration decision, it outputs detection labels, vulnerability confidence and interpretability reports.

8. The source code vulnerability detection method based on multi-source feature fusion and ensemble learning according to claim 7, characterized in that, The integrated detection module includes: Interpretability analysis unit, according to formula Calculate the gradient feature importance score for each sub-model, where For multi-source fusion vectors, The probability of a vulnerability is used to pinpoint the key feature dimensions and code locations that trigger detection. Integrated decision-making units, according to formula Dynamic weighted integration weight Output the overall confidence level of the vulnerability, derive the detection label based on the threshold, and generate an interpretable report that includes the main triggering sub-model, key feature dimensions, and vulnerability category inferences.

9. A computer device comprising a memory and a processor, the memory being electrically connected to the processor, the memory storing a computer program, characterized in that: When the computer program is executed by the processor, it causes the processor to implement the method as described in any one of claims 1 to 8.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the processor implements the method as described in any one of claims 1 to 8.

Images