Multi-modal decentration vulnerability assessment method capable of protecting privacy

Abstract

The invention provides a decentralized vulnerability assessment method based on multi-modal data fusion, belongs to the technical field of computers, and solves the technical problems that a traditional vulnerability assessment method cannot fully combine multi-modal data and cannot effectively protect data privacy. According to the technical scheme, the method comprises the following steps: S1, preprocessing a vulnerability assessment data set; s2, extracting structure information, lexical features and annotation information of the source code; s3, inputting the source code and the annotation information into a CodeT5 model, and performing multi-modal feature fusion in combination with the graph structure information processed by Joern; s4, cross-modal information fusion is carried out through an adaptive weight mechanism, and model performance is optimized; s5, carrying out model training locally; and S6, inputting the test set into the trained model for vulnerability evaluation, and outputting a classification result. And the accuracy, comprehensiveness and privacy protection capability of vulnerability assessment are improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a decentralized vulnerability assessment method based on multimodal data fusion. Background Art

[0002] In modern software development, vulnerability assessment is an important part of ensuring software security. Vulnerabilities in source code may pose serious security risks, such as remote code execution and data leakage, so effective vulnerability assessment of source code is crucial. Traditional vulnerability assessment methods usually rely on a single data modality, such as vulnerability description, source code, or code submission records. Although these methods can discover vulnerabilities to a certain extent, they fail to fully consider the multi-dimensional characteristics of the code, and the assessment results are usually not accurate and complete.

[0003] In recent years, with the rapid development of deep learning technology, vulnerability assessment methods based on deep learning have gradually become the focus of research. These methods can automatically learn the semantic representation of code through pre-trained language models, thus overcoming the limitation of traditional methods that require manual feature design. However, existing deep learning methods usually ignore the structural information and context of the code. For example, models such as CodeT5 perform vulnerability assessment by processing code text information, but fail to effectively utilize structural features such as control flow and data flow of the code, resulting in limited evaluation results.

[0004] In addition, with the rise of multimodal learning, more and more studies have attempted to combine multimodal data such as code structure information, annotation information, and lexical features for vulnerability assessment, hoping to improve the accuracy of assessment by integrating these multidimensional features. However, such methods face the problem of data privacy protection, especially in enterprise environments, where source code and developer comments may contain sensitive information that cannot be easily shared or used. Therefore, how to use multimodal data for vulnerability assessment while ensuring privacy protection has become a challenge that needs to be solved urgently.

[0005] To address these issues, decentralized learning (such as federated learning) provides the possibility for multi-party collaboration. Through decentralized learning, each participant can train the model locally and share model parameters without exposing sensitive data. However, how to effectively integrate multimodal data under the decentralized learning framework while ensuring privacy is a difficult problem in current technology.

[0006] The key to the present invention is how to combine decentralized learning with multimodal data fusion, which not only effectively solves the privacy protection problem, but also improves the comprehensiveness and accuracy of vulnerability assessment. By introducing multimodal data, especially multidimensional information such as code structure, annotations and lexical features, into the decentralized learning framework, the present invention can significantly improve the effect of the vulnerability assessment model while ensuring data privacy. Summary of the invention

[0007] The purpose of the present invention is to provide a privacy-preserving multimodal decentralized vulnerability assessment method. The method aims to improve the accuracy and comprehensiveness of vulnerability assessment by combining multimodal data through decentralized learning while protecting data privacy.

[0008] The core idea of ​​this invention is to combine the multimodal features of the code (including code structure, annotations and lexical features) through a decentralized learning method, jointly learn the patterns of different data sources under the premise of ensuring data privacy, and optimize the performance of the vulnerability assessment model. Specifically, by performing feature fusion on multimodal data, the model can comprehensively learn the feature information related to vulnerabilities, thereby effectively improving the effect of vulnerability assessment.

[0009] The present invention is implemented by the following measures: a multimodal decentralized vulnerability assessment method based on privacy protection, which includes the following steps:

[0010] 1.1: By analyzing the CVE vulnerability database and actual development projects based on the Git-based software project hosting platform, relevant vulnerability information is collected and processed into a multimodal dataset D, including code structure, annotation information, and lexical features;

[0011] 1.2: Divide the data set D collected in step 1.1 into training set and test set at a ratio of 80%:20% at random;

[0012] 1.3: Preprocess and extract features of data of different modalities, use the Joern tool to generate code attribute graphs, capture the grammatical structure and dependency relationships in the code, use the pre-trained model CodeT5 to extract semantic features of lexical information and annotation information, and convert them into vector representations;

[0013] 1.4: Align the feature embedding vectors of different modalities obtained in step 1.3, and use the self-attention mechanism to perform deep fusion to form a unified multimodal feature representation;

[0014] 1.5: In the decentralized learning model training phase, the model is distributed from the main server to multiple clients. The clients use multimodal data for training. After the training is completed, the clients upload the trained local model to the main server, which summarizes and further optimizes it. Through multiple rounds of distribution and iteration, a global model with optimal performance is finally obtained, while ensuring the privacy of client data.

[0015] 1.6: Input the test set D2 into the trained global model for vulnerability assessment, output the final assessment results, and evaluate the vulnerability type and risk level.

[0016] In step 1.1, vulnerability related information is collected to construct a vulnerability dataset, which specifically includes the following steps:

[0017] 2.1: Search for relevant open source source code on GitHub, CVE, and NVD platforms using keywords such as C, C++, Vulnerable, and function, and download them to collect source code containing vulnerabilities and related information;

[0018] 2.2: Preprocess the source code, extract the grammatical structure information of the source code, including elements such as functions, classes, and control flows, extract the comment part as text data input to supplement the context and intention of the code, convert keywords and identifiers in the source code into lexical features, and tokenize them into a processable format. In addition, remove redundant content such as noise comments and blank lines, unify variables into var1, var2, and unify functions into func1, func2, etc.

[0019] 2.3: The collected vulnerable codes are used to construct a vulnerability assessment dataset D based on the CVSS v2 standard. This dataset D will serve as the basis for subsequent model training and evaluation, and contains multimodal features for training and corresponding vulnerability labels;

[0020] In the step 1.3, the data of different modes obtained in step 1.1 are preprocessed, and features are extracted using the Joern tool and the CodeT5 model, and converted into vector representations, which specifically includes the following steps:

[0021] 3.1: Use the Joern tool to generate a code property graph, which captures the various components of the code and the relationships between them by analyzing the grammatical structure, control flow, and dependencies of the code;

[0022] 3.2: Use the CodeT5 model to extract semantic features from the lexical information and annotation information of the source code and convert the text data into vector representation;

[0023] In step 1.4, the feature embedding vectors of different modalities obtained in step 1.3 are aligned, and deeply fused using the self-attention mechanism to form a unified multimodal feature representation, which specifically includes the following steps:

[0024] 4.1: Align the feature embedding vectors extracted from different modalities (code structure, lexical information, comments). Here we use binary hash coding for alignment to map the features of all modalities to the same vector space;

[0025] 4.2: Use the self-attention mechanism to deeply fuse the aligned multimodal features. By calculating the similarity and dependency between different modal features, the interaction of cross-modal information is enhanced. The specific formula is as follows:

[0026]

[0027] Where Q is the query vector, K is the key vector, V is the value vector, and d k is the dimension of the key vector, and the softmax function is used to calculate the attention weight;

[0028] 4.3: Through the above self-attention mechanism, the features of each modality are effectively integrated to generate a unified multimodal feature representation for subsequent training and evaluation;

[0029] In the decentralized learning model training in step 1.5, the model is distributed from the main server to multiple clients, the clients use multimodal data for training, and the final global model is optimized through multiple rounds of iterations, specifically including the following steps:

[0030] 5.1: The main server distributes the initial model to multiple clients. Each client uses its own local multimodal data for training. The client uses local data for training and updates the local model. The client uploads the trained local model to the main server. The main server aggregates and merges the model parameters from each client. Through multiple rounds of distribution and iteration, the global model is optimized. The model parameters of each round are updated locally and then uploaded to the main server. Iterate multiple rounds until the global model reaches the optimal performance.

[0031] 5.2: In order to reduce the difference between the global model and the local model, a weighted variance minimization loss function is introduced to ensure that the global model and the local model gradually converge during the training process. The specific formula is as follows:

[0032]

[0033] Among them, L variance To minimize the weighted variance loss, w i is the weight of the i-th local model, θ globalare the parameters of the global model, is the parameter of the i-th local model, n is the number of local models, and by minimizing the loss function, the consistency of the global model and the local model is ensured, thereby improving the accuracy and robustness of the global model;

[0034] 5.3: Introduce a momentum-based weight distribution strategy to optimize the contribution of each client to the global model training. This strategy dynamically adjusts the contribution weight of each client based on the quality of the client data and the local training effect to ensure that higher quality data contributes more to the global model. The specific formula is as follows:

[0035]

[0036] in, is the new weight of the i-th client in the current iteration, is the old weight of the i-th client in the previous iteration, β is the momentum hyperparameter, which controls the influence of historical weights, is the loss function gradient of the i-th client, The modulus of the gradient reflects the effect of training. This momentum strategy can effectively increase the focus on effective local data during training and prevent low-quality data from excessively affecting the global model.

[0037] 5.4: Based on the heterogeneity of the data and the training status of the model, a dynamic learning rate mechanism is introduced to adaptively adjust the learning rate during the training process. This mechanism dynamically changes the learning rate size based on the training feedback of each client, thereby improving the training efficiency and accuracy. The specific formula is as follows:

[0038]

[0039] Among them, λ is the regularization constant, which is used to control the amplitude of learning rate update, grad magnitude The size of the gradient reflects the update amplitude of the model training. The dynamic learning rate mechanism helps the model adjust the learning rate according to the difficulty and heterogeneity of the data during the training process, thereby improving the training efficiency and accuracy of the global model;

[0040] 5.5: During this process, the client only trains the model with local data and uploads the updated model parameters without uploading the original data to the main server, thus effectively avoiding the risk of data leakage;

[0041] In step 1.6, the test set D2 is input into the trained global model for vulnerability assessment, and the final assessment result is output to assess the vulnerability type and risk level.

[0042] Compared with the prior art, the present invention has the following beneficial effects:

[0043] 1. By integrating multimodal data (including code structure, annotation information, and lexical features), the present invention can more comprehensively capture potential vulnerabilities in the code and significantly improve the accuracy of vulnerability assessment. At the same time, by introducing the self-attention mechanism to deeply integrate information from different modalities, the robustness of the model is effectively enhanced, and its applicability in different data and scenarios is improved.

[0044] 2. Through the decentralized learning framework, only model parameters are transmitted instead of original data, ensuring the privacy protection of the client. Combined with technologies such as differential privacy and encryption, the effect of multi-client collaborative training is improved while ensuring data security, avoiding the risk of data leakage.

[0045] 3. Through innovative methods such as weighted variance minimization loss, momentum-based weight allocation strategy and dynamic learning rate mechanism, the training effect of the global model under different clients and heterogeneous data is significantly improved, and the performance and convergence speed in the training process are optimized. The multimodal vulnerability assessment method of the present invention is not only applicable to open source code, but can also be extended to closed source code and other types of software vulnerability detection, and has broad application prospects.

[0046] 4. The decentralized learning framework can also be applied in different industry fields, especially in scenarios with high requirements for data privacy, where it has unique advantages. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention.

[0048] Figure 1 A system framework diagram of a privacy-preserving multimodal decentralized vulnerability assessment method provided by the present invention. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. Of course, the specific embodiments described here are only used to explain the present invention and are not used to limit the present invention.

[0050] Example 1

[0051] See also Figure 1 As shown, the present invention provides a multimodal decentralized vulnerability assessment method based on privacy protection, which specifically includes the following steps:

[0052] (1-1) By analyzing the CVE vulnerability database and actual development projects based on the Git-based software project hosting platform, relevant vulnerability information is collected and processed into a multimodal dataset D, including code structure, annotation information, and lexical features;

[0053] (1-2) Divide the data set D collected in step (1-1) into a training set and a test set at a ratio of 80%:20%;

[0054] (1-3) Preprocess and extract features from data of different modalities, use the Joern tool to generate a code attribute graph, capture the grammatical structure and dependency relationships in the code, use the pre-trained model CodeT5 to extract semantic features from lexical information and annotation information, and convert them into vector representations;

[0055] (1-4) Align the feature embedding vectors of different modalities obtained in step (1-3), and use the self-attention mechanism to perform deep fusion to form a unified multimodal feature representation;

[0056] (1-5) In the decentralized learning model training phase, the model is distributed from the main server to multiple clients. The clients use multimodal data for training. After the training is completed, the clients upload the trained local models to the main server, which summarizes and further optimizes them. Through multiple rounds of distribution and iteration, a global model with optimal performance is finally obtained while ensuring the privacy of client data.

[0057] (1-6) Input the test set D2 into the trained global model for vulnerability assessment and output the final assessment results to evaluate the vulnerability type and risk level.

[0058] The step (1-1) collects vulnerability-related information to construct a vulnerability dataset, which specifically includes the following steps:

[0059] (2-1) Search for relevant open source code on GitHub, CVE, and NVD platforms using keywords such as C, C++, Vulnerable, and function, and download them to collect source code containing vulnerabilities and related information;

[0060] (2-2) Preprocess the source code, extract the grammatical structure information of the source code, including elements such as functions, classes, and control flows, extract the comment part as text data input to supplement the context and intention of the code, convert keywords and identifiers in the source code into lexical features, and tokenize them into a processable format. In addition, it removes redundant content such as noise comments and blank lines, unifies variables into forms such as var1 and var2, and unifies functions into forms such as func1 and func2;

[0061] (2-3) The collected vulnerable codes are constructed into a vulnerability assessment dataset D based on the CVSS v2 standard. The dataset D will serve as the basis for subsequent model training and evaluation, and contains multimodal features used for training and corresponding vulnerability labels;

[0062] In the step (1-3), the data of different modes obtained in the step (1-1) are preprocessed, and features are extracted using the Joern tool and the CodeT5 model to convert them into vector representations, which specifically includes the following steps:

[0063] (3-1) Use the Joern tool to generate a code property graph, which captures the various components of the code and the relationships between them by analyzing the grammatical structure, control flow, and dependencies of the code;

[0064] (3-2) Use the CodeT5 model to extract semantic features from the lexical information and annotation information of the source code and convert the text data into vector representation;

[0065] In the step (1-4), the feature embedding vectors of different modalities obtained in the step (1-3) are aligned, and deeply fused using the self-attention mechanism to form a unified multimodal feature representation, which specifically includes the following steps:

[0066] (4-1) Align the feature embedding vectors extracted from different modalities (code structure, lexical information, comments). Here we use binary hash coding for alignment to map the features of all modalities to the same vector space;

[0067] (4-2) Use the self-attention mechanism to deeply fuse the aligned multimodal features. By calculating the similarity and dependency between different modal features, the interaction of cross-modal information is enhanced. The specific formula is as follows:

[0068]

[0069] Where Q is the query vector, K is the key vector, V is the value vector, and d k is the dimension of the key vector, and the softmax function is used to calculate the attention weight;

[0070] (4-3) Through the above-mentioned self-attention mechanism, the features of each modality are effectively integrated to generate a unified multimodal feature representation for subsequent training and evaluation;

[0071] In the decentralized learning model training in the steps (1-5), the model is distributed from the main server to multiple clients, the clients use multimodal data for training, and the final global model is optimized through multiple rounds of iterations, specifically including the following steps:

[0072] (5-1) The main server distributes the initial model to multiple clients. Each client uses its own local multimodal data for training. The client uses local data to train and update the local model. The client uploads the trained local model to the main server. The main server aggregates and merges the model parameters from each client. Through multiple rounds of distribution and iteration, the global model is optimized. The model parameters of each round are updated locally and then uploaded to the main server. Multiple rounds of iteration are repeated until the global model reaches the optimal performance.

[0073] (5-2) In order to reduce the difference between the global model and the local model, a weighted variance minimization loss function is introduced to ensure that the global model and the local model gradually converge during the training process. The specific formula is as follows:

[0074]

[0075] Among them, L variance To minimize the weighted variance loss, w i is the weight of the i-th local model, θ global are the parameters of the global model, is the parameter of the i-th local model, n is the number of local models, and by minimizing the loss function, the consistency of the global model and the local model is ensured, thereby improving the accuracy and robustness of the global model;

[0076] (5-3) Introduce a momentum-based weight allocation strategy to optimize the contribution of each client to the global model training. This strategy dynamically adjusts the contribution weight of each client according to the quality of the client data and the local training effect, ensuring that higher quality data contributes more to the global model. The specific formula is as follows:

[0077]

[0078] in, is the new weight of the i-th client in the current iteration, is the old weight of the i-th client in the previous iteration, β is the momentum hyperparameter, which controls the influence of historical weights, is the loss function gradient of the i-th client, The modulus of the gradient reflects the effect of training. This momentum strategy can effectively increase the focus on effective local data during training and prevent low-quality data from excessively affecting the global model.

[0079] (5-4) Based on the heterogeneity of the data and the training status of the model, a dynamic learning rate mechanism is introduced to adaptively adjust the learning rate during the training process. This mechanism dynamically changes the learning rate size based on the training feedback of each client, thereby improving the training efficiency and accuracy. The specific formula is as follows:

[0080]

[0081] Among them, λ is the regularization constant, which is used to control the amplitude of learning rate update, grad magnitude The size of the gradient reflects the update amplitude of the model training. The dynamic learning rate mechanism helps the model adjust the learning rate according to the difficulty and heterogeneity of the data during the training process, thereby improving the training efficiency and accuracy of the global model;

[0082] (5-5) In this process, the client only trains the model with local data and uploads the updated model parameters without uploading the original data to the main server, thus effectively avoiding the risk of data leakage;

[0083] In the steps (1-6), the test set D2 is input into the trained global model for vulnerability assessment, and the final assessment result is output to assess the vulnerability type and risk level.

[0084] (7) The proposed method is compared with existing vulnerability assessment methods on the same data set, and five performance indicators (accuracy, precision, recall, F1 score, MCC) from the field of software vulnerability task research are used to automatically evaluate the quality of the model:

[0085] Table 1 Comparison of results between the method of the present invention and other methods

[0086]

[0087] Experiments have shown that the privacy-preserving multimodal decentralized vulnerability assessment method proposed in this embodiment can perform more accurate vulnerability assessments than the baseline method. Specifically, the method in this embodiment uses the Joern tool to generate a code property graph, and uses the CodeT5 model to extract the semantic features of lexical and annotations. Then, the self-attention mechanism is used to deeply fuse the features of different modalities to generate a unified multimodal feature representation. In the decentralized learning training phase, privacy is protected by transmitting only model parameters instead of raw data, and three key improvements are introduced: weighted variance minimization loss to reduce the difference between global and local models, momentum-based weight allocation strategy to optimize client contribution, and dynamic learning rate mechanism to improve training efficiency. The model performance of this embodiment can surpass these baseline methods; among them, for accuracy, the method of this embodiment can at least relatively improve the performance by 9.19%; for precision, the method of this embodiment can at least relatively improve the performance by 4.53%; for recall rate, the method of this embodiment can at least relatively improve the performance by 11.42%; for F1 score, the method of this embodiment can at least relatively improve the performance by 8.66%; for MCC, the method of this embodiment can at least relatively improve the performance by 24.75%; these results show the competitiveness of the method proposed in this embodiment.

[0088] Example 2

[0089] On the basis of Example 1, in order to study the impact of different input modalities on model performance, the method of the present invention is compared by combining different types of input information, involving three modalities: (1) code structure information, (2) vocabulary information from the code, and (3) annotation information. The code structure information is represented as S, the vocabulary information is represented as L, and the annotation information is represented as C. By combining these modalities, the contribution of each modality to the model performance is evaluated.

[0090] Table 2 Comparison of results of the method of the present invention and other methods

[0091]

[0092] Experiments have shown that the multimodal information input provided by the present invention has a relative improvement of 10.11% to 26.25% in accuracy compared to the use of other input information. The precision rate increased the most, with a relative increase of 7.26% to 46.92%. The recall rate increased by 14.29% to 32.59%, the F1 score increased by 3.92% to 32.95%, and the MCC increased by 5.75% to 32.14%. These results show that the performance of the model will improve as the number of information modalities increases. The fusion of the three modalities further enhances the model's ability to perform comprehensive evaluation, enabling it to evaluate vulnerabilities from multiple levels (grammar, lexical features, and semantic content of comments), thereby improving the performance of vulnerability assessment.

[0093] Example 3

[0094] On the basis of Example 1, in order to study how the decentralized learning framework improves the effectiveness of vulnerability assessment tasks, the present invention makes three experimental settings: a centralized model without decentralized learning, a standard decentralized learning model using the FedAvg algorithm, and a model setting of the present invention. In the centralized model setting, all data is stored on a single server for training, and there is no collaboration or parameter sharing between clients, as a baseline for comparison. The FedAvg method enables clients to independently train local models and send their parameters to a central server for aggregation, thereby facilitating distributed learning, but it is difficult to handle data heterogeneity. In contrast, the model setting of the present invention combines a momentum mechanism with a dynamic learning rate to optimize parameter updates and dynamically adjust client contributions through adaptive weight distribution. This example uses three evaluation metrics: accuracy, recall, and F1 score to compare the performance of each setting and determine the most effective model setting.

[0095] Table 2 Comparison of results of the method of the present invention and other methods

[0096]

[0097]

[0098] Experiments have shown that the decentralized learning framework provided by the present invention effectively promotes information sharing and collaborative optimization among clients, enables local knowledge to be integrated into the global model, and significantly improves its generalization ability. In addition, the present invention uses momentum mechanisms and dynamic learning rates to alleviate the challenges brought by data heterogeneity, thereby improving the convergence speed and model stability. The method of the present invention has a relative improvement of 3.29% to 14.79% in accuracy, 4.25% to 9.71% in recall, and 5.18% to 14.05% in F1 score. These results show that the model setting of the present invention effectively improves the performance of vulnerability assessment.

[0099] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A privacy-preserving multimodal decentralized vulnerability assessment method, where: The following steps are involved: 1.1: By analyzing the CVE vulnerability database and actual development projects based on the Git-based software project hosting platform, relevant vulnerability information is collected and processed into a multimodal dataset D, including code structure, annotation information, and lexical features; 1.2: Divide the data set D collected in step 1.1 into training set and test set at a ratio of 80%:20% at random; 1.3: Preprocess and extract features of data of different modalities, use the Joern tool to generate code attribute graphs, capture the grammatical structure and dependency relationships in the code, use the pre-trained model CodeT5 to extract semantic features of lexical information and annotation information, and convert them into vector representations; 1.4: Align the feature embedding vectors of different modalities obtained in step 1.3, and use the self-attention mechanism to perform deep fusion to form a unified multimodal feature representation; 1.5: In the decentralized learning model training phase, the model is distributed from the main server to multiple clients. The clients use multimodal data for training. After the training is completed, the clients upload the trained local model to the main server, which summarizes and optimizes it. Through multiple rounds of distribution and iteration, a global model with optimal performance is finally obtained, while ensuring the privacy of client data. 1.6: Input the test set D2 into the trained global model for vulnerability assessment, output the final assessment results, and evaluate the vulnerability type and risk level.

2. The privacy-preserving multimodal decentralized vulnerability assessment method according to claim 1, characterized in that: In step 1.1, vulnerability related information is collected to construct a vulnerability dataset, which specifically includes the following steps: 2.1: Search for relevant open source source code on GitHub, CVE, and NVD platforms using keywords such as C, C++, Vulnerable, and function, and download them to collect source code containing vulnerabilities and related information; 2.2: Preprocess the source code, extract the grammatical structure information of the source code, including elements such as functions, classes, and control flows, extract the comment part as text data input to supplement the context and intention of the code, convert keywords and identifiers in the source code into lexical features, and tokenize them into a processable format. In addition, remove redundant content such as noise comments and blank lines, unify variables into var1, var2, and unify functions into func1, func2, etc. 2.3: The collected vulnerable codes are constructed into a vulnerability assessment dataset D based on the CVSS v2 standard. This dataset D will serve as the basis for subsequent model training and evaluation, and contains multimodal features for training and corresponding vulnerability labels.

3. The privacy-preserving multimodal decentralized vulnerability assessment method according to claim 1, characterized in that: In the step 1.3, the data of different modes obtained in step 1.1 are preprocessed, and features are extracted using the Joern tool and the CodeT5 model, and converted into vector representations, which specifically includes the following steps: 3.1: Use the Joern tool to generate a code property graph, which captures the various components of the code and the relationships between them by analyzing the grammatical structure, control flow, and dependencies of the code; 3.2: Use the CodeT5 model to extract semantic features from the lexical information and annotation information of the source code and convert the text data into vector representation.

4. The privacy-preserving multimodal decentralized vulnerability assessment method according to claim 1, characterized in that: In step 1.4, the feature embedding vectors of different modalities obtained in step 1.3 are aligned, and deeply fused using the self-attention mechanism to form a unified multimodal feature representation, which specifically includes the following steps: 4.1: Align the feature embedding vectors extracted from different modalities (code structure, lexical information, comments); here we use binary hash coding for alignment to map the features of all modalities to the same vector space; 4.2: Use the self-attention mechanism to deeply fuse the aligned multimodal features, and enhance the interaction of cross-modal information by calculating the similarity and dependency between different modal features. The specific formula is as follows: Where Q is the query vector, K is the key vector, V is the value vector, and d k is the dimension of the key vector, and the softmax function is used to calculate the attention weight; 4.3: Through the above self-attention mechanism, the features of each modality are effectively integrated to generate a unified multimodal feature representation for subsequent training and evaluation.

5. The privacy-preserving multimodal decentralized vulnerability assessment method according to claim 1, characterized in that: In the decentralized learning model training in step 1.5, the model is distributed from the main server to multiple clients, the clients use multimodal data for training, and the final global model is optimized through multiple rounds of iterations, specifically including the following steps: 5.1: The main server distributes the initial model to multiple clients. Each client uses its own local multimodal data for training. The client uses local data for training and updates the local model. The client uploads the trained local model to the main server. The main server aggregates and merges the model parameters from each client. Through multiple rounds of distribution and iteration, the global model is optimized. The model parameters of each round are updated locally and then uploaded to the main server. Iterate multiple rounds until the global model reaches the optimal performance. 5.2: Reduce the difference between the global model and the local model, introduce the weighted variance minimization loss function, and ensure that the global model and the local model gradually converge during the training process. The specific formula is as follows: Among them, L variance To minimize the weighted variance loss, w i is the weight of the i-th local model, θ global are the parameters of the global model, θ locali is the parameter of the i-th local model, n is the number of local models, and by minimizing the loss function, the consistency of the global model and the local model is ensured, thereby improving the accuracy and robustness of the global model; 5.3: Introduce a momentum-based weight allocation strategy to optimize the contribution of each client to the global model training. This strategy dynamically adjusts the contribution weight of each client according to the quality of the client data and the local training effect to ensure that higher quality data contributes more to the global model. The specific formula is as follows: in, is the new weight of the i-th client in the current iteration, is the old weight of the i-th client in the previous iteration, β is the momentum hyperparameter that controls the influence of historical weights, ▽L i is the gradient of the loss function of the i-th client, ‖▽L i ‖ represents the modulus of the gradient, which reflects the effect of training. Through this momentum strategy, we can effectively increase the attention paid to effective local data during training and avoid excessive impact of low-quality data on the global model. 5.4: According to the heterogeneity of the data and the training status of the model, a dynamic learning rate mechanism is introduced to adaptively adjust the learning rate during the training process. This mechanism dynamically changes the learning rate size according to the training feedback of each client, thereby improving the training efficiency and accuracy. The specific formula is as follows: Among them, λ is the regularization constant, which is used to control the amplitude of learning rate update, grad magnitude The size of the gradient reflects the update amplitude of the model training. The dynamic learning rate mechanism helps the model adjust the learning rate according to the difficulty and heterogeneity of the data during the training process, thereby improving the training efficiency and accuracy of the global model; 5.5: During this process, the client only trains the model through local data and uploads the updated model parameters without uploading the original data to the main server, thus effectively avoiding the risk of data leakage.

6. The privacy-preserving multimodal decentralized vulnerability assessment method according to claim 1, characterized in that: In step 1.6, the test set D2 is input into the trained global model for vulnerability assessment, and the final assessment result is output to assess the vulnerability type and risk level.

Images