Intelligent location method for software supply chain vulnerabilities based on multimodal feature fusion

Abstract

The present invention relates to the field of data processing technology, and in particular to a method for intelligently locating software supply chain vulnerabilities by fusion of multimodal features, comprising: encrypting and aggregating code structure data, dependency component metadata, and runtime behavior logs of distributed nodes through a federated learning framework to generate a cross-node encrypted feature set; outputting multimodal training samples by combining dynamic behavior sequence similarity comparison; extracting cross-modal correlation features of code structure nodes, text entity embedding vectors, and dynamic event sequences through a multi-head cross-attention mechanism to generate a fused feature vector; utilizing a graph attention network to quantify the probability of vulnerability propagation between components and identify high-risk dependency paths associated with the code structure. The present invention breaks through the limitations of single-modality analysis through a collaborative mechanism of multimodal feature alignment, dependency graph risk quantification, and reinforcement learning dynamic decision-making, thereby improving the accuracy, cross-ecological generalization capability, and interpretability of vulnerability location in complex supply chain scenarios.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a method for intelligently locating software supply chain vulnerabilities by integrating multimodal features. Background Art

[0002] Software supply chain vulnerability detection involves analyzing third-party libraries, toolchains, and dependent components introduced during the software development process to identify security risks caused by external code defects or malicious implants. Software supply chain vulnerability detection often relies on single-dimensional feature analysis, such as statically inspecting code syntax or dynamically monitoring runtime abnormal behavior. This approach fails to effectively integrate heterogeneous data from multiple sources, resulting in insufficient characterization of complex vulnerability patterns. Because high-risk vulnerabilities exhibit a long-tail distribution and their labeling relies on the experience of security experts, real-world scenarios face bottlenecks such as a scarcity of samples and poor cross-project generalization.

[0003] In the field of software supply chain vulnerability detection, existing technologies typically rely on single-modal feature analysis, such as static code structure or dynamic runtime behavior, failing to fully capture the multi-dimensional characteristics of vulnerabilities. Due to the long-tail distribution of vulnerabilities and the scarcity of samples, the annotation of high-risk vulnerabilities relies heavily on manual verification by security experts, resulting in limited annotated datasets and limited coverage of specific scenarios. Furthermore, semantic gaps exist between multimodal data (such as code structure, textual semantics, and dynamic behavior). Existing methods face model parameter inflation and noise overfitting issues when aligning and fusing cross-modal features. In cross-project or cross-language scenarios, differences in coding styles, dependency ecosystems, and vulnerability patterns across codebases further fragment the feature space. Existing transfer learning techniques struggle to effectively decouple the complex relationships between code syntax and vulnerability logic, resulting in insufficient model generalization. Traditional methods fail to fully integrate supply chain dependency graphs with multimodal data, limiting the accuracy of vulnerability propagation path tracing and making it difficult to address the complex security risks in the continuously evolving software supply chain environment. Summary of the Invention

[0004] In response to the shortcomings of the existing technology, the present invention provides a method for intelligently locating software supply chain vulnerabilities by fusion of multimodal features, which solves the problems in the existing technology: the software supply chain vulnerability detection method lacks vulnerability representation dimensions due to single modal feature analysis, and the semantic gap between static code structure, dynamic behavior and text semantic data causes difficulty in cross-modal feature fusion, resulting in feature redundancy and noise interference; the long-tail distribution characteristics of high-risk vulnerabilities and the high cost of manual labeling lead to increased sample scarcity, and the model is prone to overfitting local noise features under small sample conditions; the grammatical differences of different programming languages and the cross-project dependency ecosystem diversity split the multimodal feature space, and the existing transfer learning technology is difficult to achieve effective decoupling of code syntax and vulnerability logic, which restricts the model's cross-domain generalization ability; the dependency graph is not sufficiently fused with multimodal data, and the vulnerability propagation path analysis is limited to the local correlation of the component call chain, and it is impossible to accurately track the vulnerability diffusion path between supply chain levels, resulting in insufficient vulnerability positioning accuracy in a complex supply chain environment.

[0005] In order to solve the above technical problems, the specific technical solutions of the present invention are as follows:

[0006] The multimodal feature fusion software supply chain vulnerability intelligent location method provided by the present invention includes:

[0007] Collect multimodal data from the target software system and encrypt and aggregate the code structure data, dependency component metadata, and runtime behavior logs of distributed nodes through a federated learning framework to generate a cross-node encrypted feature set.

[0008] The encrypted feature set is input into a conditional generative adversarial network, the generator network generates code variants that are semantically consistent with the real vulnerability scenario, and the discriminator network compares the similarity of dynamic behavior sequences to output multimodal training samples;

[0009] Input the multimodal training samples into a multi-head cross attention mechanism to extract cross-modal correlation features between function call nodes, text entity embedding vectors, and dynamic event sequence encodings in the code structure graph to generate a fused feature vector;

[0010] Based on the metadata of the dependent components, a supply chain dependency graph is constructed through a graph attention network to quantify the probability of vulnerability propagation between components. The fused feature vector is input into the graph attention network to identify high-risk dependency paths associated with code structure nodes in the dependency graph.

[0011] A differentiable reinforcement learning framework is adopted to perform serialized scanning of the target code based on the vulnerability propagation probability of the high-risk dependency path and the attention weight of the cross-modal association feature, dynamically adjust the vulnerability location threshold strategy, and output the vulnerable code segment and associated dependency chain.

[0012] Furthermore, in the multimodal feature fusion software supply chain vulnerability intelligent location method described in the present invention, the federated learning framework includes: encrypting and aggregating the code structure data, dependency component metadata, and runtime behavior logs through a secure multi-party computing protocol to generate global feature statistics;

[0013] Based on the reinforcement learning agent, the change frequency of the code structure data and the risk level of the dependent component metadata are analyzed, and the data sampling weight of each distributed node is dynamically adjusted to prioritize the collection of code features of frequently changed modules and version metadata of high-risk dependent components.

[0014] Furthermore, in the multimodal feature fusion software supply chain vulnerability intelligent location method of the present invention, the conditional generative adversarial network includes: inputting global feature statistics generated by the federated learning framework into a generator network, and constraining the generated code variants to conform to abstract syntax tree rules through a code structure parser;

[0015] The generated code variants and dynamic behavior sequences are input into the discriminator network, and the generator network is iteratively optimized to generate semantically consistent multimodal training samples.

[0016] Furthermore, in the multimodal feature fusion software supply chain vulnerability intelligent location method described in the present invention, the multi-head cross attention mechanism includes: based on the fused feature vector, parallel calculation of the cross-modal association weights of the function call nodes in the code structure graph and the component nodes in the supply chain dependency graph;

[0017] The embedding vectors of the code structure nodes, the text entity description encoding and the dynamic event sequence features are subjected to hierarchical attention interaction to generate a cross-modal consistent feature representation.

[0018] Furthermore, in the multimodal feature fusion software supply chain vulnerability intelligent positioning method described in the present invention, the graph attention network includes: updating the node risk characteristics of the supply chain dependency graph based on the version information and vulnerability disclosure records of the dependent component metadata; calculating the reachability probability of the vulnerability in the multi-layer dependency chain through the attention weight propagation algorithm, and using the reachability probability as the positioning strategy input parameter of the differentiable reinforcement learning framework.

[0019] Furthermore, the multimodal feature fusion software supply chain vulnerability intelligent location method described in the present invention includes the following: based on the vulnerability propagation probability of the high-risk dependency path and the attention weight of the cross-modal correlation feature, constructing a state space including a code context semantic vector, historical false positive statistics, and dependency risk score;

[0020] A reward function is set to evaluate the balance between vulnerability localization accuracy and false alarm suppression effect, and the localization threshold decision parameters in the state space are optimized through a policy gradient algorithm.

[0021] Furthermore, the multimodal feature fusion software supply chain vulnerability intelligent location method of the present invention also includes:

[0022] The generated global feature statistics are used as the generator input of the conditional generative adversarial network to constrain the semantic consistency of the generated code variants with the global feature statistics; the dynamic behavior sequences of the generated adversarial samples and real vulnerability samples are compared through the discriminator network, and the discrimination results are transmitted back to the federated learning node to optimize the code structure feature extraction rules of the distributed nodes.

[0023] Furthermore, the multimodal feature fusion software supply chain vulnerability intelligent location method of the present invention also includes:

[0024] The component risk probability calculated by the graph attention network is used as the weight constraint of the multi-head cross attention mechanism to suppress the interaction between the associated features of code structure nodes and low-risk dependency paths;

[0025] The cross-modal consistency feature representation generated by the multi-head cross-attention mechanism is used to correct the edge weight parameters of the supply chain dependency graph and optimize the quantitative accuracy of the vulnerability propagation probability.

[0026] Furthermore, the multimodal feature fusion software supply chain vulnerability intelligent location method of the present invention also includes:

[0027] The vulnerability propagation probability of the identified high-risk dependency path is used as the state space prior knowledge of the differentiable reinforcement learning framework to dynamically narrow the scanning scope of the target code;

[0028] The vulnerability localization results output by the differentiable reinforcement learning framework are used to reversely update the node risk features of the graph attention network.

[0029] Furthermore, the multimodal feature fusion software supply chain vulnerability intelligent location method of the present invention also includes:

[0030] A prototype network is used to cluster vulnerability features of multimodal training samples and construct vulnerability pattern prototype vectors across programming language projects.

[0031] The localization strategy parameters of the differentiable reinforcement learning framework are transferred to a lightweight explanation model through attention distillation technology to generate heat map explanation information corresponding to the vulnerability code segment and the associated dependency chain.

[0032] Beneficial effects of the present invention:

[0033] The present invention significantly improves the comprehensiveness and accuracy of software supply chain vulnerability detection through multimodal feature fusion and collaborative optimization mechanism. Based on the federated learning framework, secure aggregation of cross-node data is achieved, and combined with the generative adversarial network to enhance sample diversity, effectively alleviating the problem of model overfitting in small sample scenarios; the multi-head cross-attention mechanism aligns the cross-modal features of code structure, text semantics and dynamic behavior, eliminating the semantic gap and reducing noise interference, the graph attention network quantifies the vulnerability propagation probability of the dependency graph, and the differentiable reinforcement learning framework is combined to dynamically optimize the positioning strategy to achieve accurate adaptation of risk scoring and scanning range; the prototype network and attention distillation technology construct a cross-language vulnerability pattern prototype, and enhance the model interpretability through heat map interpretation, assisting expert verification and closed-loop optimization. The synergistic effect of the above technologies breaks through the limitations of traditional single-modal analysis, improves cross-ecological generalization capabilities while ensuring data security, accurately tracks the vulnerability propagation path of complex dependency chains, and provides efficient and reliable technical support for software supply chain security governance. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the technical solution of the present invention, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, for ordinary technicians in this field, other drawings can be obtained based on the drawings without paying any creative labor.

[0035] Figure 1 This is a flowchart of a method for intelligently locating software supply chain vulnerabilities using multimodal feature fusion provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solutions and advantages of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below in conjunction with the specific embodiments of the present invention and the corresponding drawings. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. The technical solutions provided by each embodiment of the present invention are described in detail below in conjunction with the drawings. In order to better understand the purpose of the present invention, the present invention is further described in detail below.

[0037] See also Figure 1 The multimodal feature fusion software supply chain vulnerability intelligent positioning method provided by the present invention includes:

[0038] Step S101: collect multimodal data from the target software system, encrypt and aggregate the code structure data, dependency component metadata, and runtime behavior logs of distributed nodes through a federated learning framework, and generate a cross-node encrypted feature set.

[0039] A closed technical loop is formed through multimodal data collection, federated learning encrypted aggregation, and dynamic sampling optimization. The collaborative collection of heterogeneous data from multiple sources provides multi-dimensional input for vulnerability detection. Federated learning's data security mechanism addresses the data sharing challenges in distributed scenarios, and dynamic sampling strategies enhance the representativeness and risk-focusing capabilities of feature sets. The encrypted feature set serves as the foundation for subsequent generative adversarial networks and cross-modal alignment. Its generation logic and data quality directly impact the model's accuracy in representing complex vulnerability patterns, thus supporting the effective implementation of the overall technical solution.

[0040] When collecting multimodal data for the target software system, the multimodal data includes the following three categories:

[0041] Code structure data: Static analysis tools parse source code or binary files to extract syntactic features such as function call relationships, control flow graphs, and variable dependencies from the abstract syntax tree. This data represents the static logical structure of the code, such as function nesting levels, conditional branch paths, and data flow rules, providing a syntactic analysis foundation for vulnerability detection.

[0042] Dependency component metadata: Dependency management tools scan project configuration files (such as pom.xml or package.json) to obtain third-party library version numbers, license types, component call hierarchies, and compatibility declarations. This data reflects the external dependency ecosystem of the software supply chain, including historical vulnerability records of high-risk component versions and the topology of dependency chains, which is used to assess potential risks introduced by dependencies.

[0043] Runtime behavior logging: Dynamic probes monitor the target system's execution process, collecting memory access traces, system call sequences, inter-process communication events, and the timing of abnormal signal triggering. This data records the actual behavior patterns of the program at runtime, such as the characteristics of buffer out-of-bounds operations and the combined paths of abnormal system calls, providing behavioral evidence for dynamic vulnerability triggering mechanisms.

[0044] These three types of data construct a heterogeneous feature space from the dimensions of code syntax, dependency ecosystem, and dynamic behavior, covering the static logic, supply chain context, and runtime semantics required for vulnerability characterization. The collaborative collection of multimodal data provides multi-source input for subsequent federated learning encryption aggregation, cross-modal feature alignment, and vulnerability propagation path analysis, supporting the full lifecycle detection of complex vulnerability patterns.

[0045] Step S102: Input the encrypted feature set into a conditional generative adversarial network, generate code variants that are semantically consistent with the real vulnerability scenario through the generator network, and compare the similarity of dynamic behavior sequences through the discriminator network to output multimodal training samples;

[0046] When the encrypted feature set is input into the generator network, the encrypted features are first homomorphically decrypted and decoded to restore them to parsable code semantic features. The generator network has a built-in code structure parsing module that verifies the grammatical constraints of feature vectors based on the abstract syntax tree rules, restricting the variable scope closure, control flow integrity, and function call legitimacy of the generated code. Through a multi-layer Transformer architecture, the cross-node vulnerability pattern features in the global feature statistics are fused with the local code syntax features to generate code variants that comply with programming language specifications and carry potential vulnerability semantics, such as function interfaces with unverified input parameters or loop structures with buffer overflow risks.

[0047] The discriminator network receives the code variants output by the generator and real-world vulnerability samples. It uses dynamic probes to collect runtime behavior sequences of both in a simulated execution environment. These behavior sequences include memory access traces, system call chains, and the timing of abnormal signal triggering. After extracting multi-scale temporal features using a temporal convolutional network, it calculates a behavioral similarity score between the generated and real-world samples. The discriminator constructs an adversarial loss function, generating a gradient signal based on the differences in the behavior sequences. This gradient signal is then back-propagated to the generator network to adjust parameters, driving the generation strategy to align with the semantic features of real-world vulnerability scenarios.

[0048] The adversarial training of the generator and discriminator forms an iterative optimization process. The generator explores the characteristic combinations of vulnerability patterns within grammatical constraints and generates code variants with potential threats. The discriminator selects high-fidelity samples based on differences in dynamic behavior characteristics, forming an adversarial feedback mechanism. After each round of training, generated samples that meet the semantic consistency standard are retained and combined with real samples to form a multimodal training sample set, covering the multi-dimensional features of code structure, dynamic behavior, and vulnerability semantics. This sample set expands data diversity, mitigating the risk of overfitting the model to local noise in small sample scenarios.

[0049] Generative adversarial networks and the federated learning framework form a collaborative optimization mechanism. The behavioral difference features output by the discriminator are fed back to the federated learning node via the gradient return path, guiding the local feature extractor to optimize the code structure parsing rules. For example, when the discriminator identifies that the generated sample has significant differences from the real sample in terms of memory out-of-bounds behavior, the federated learning node increases the parsing weight of the memory operation pattern, improving the representation capability of subsequent encrypted aggregate features. During the data augmentation process, the generative adversarial network inherits the global vulnerability pattern characteristics of federated learning, forming semantic consistency constraints across nodes, and enhancing the coverage of generated samples for multi-source vulnerability scenarios.

[0050] The above steps form a closed-loop optimization chain through encrypted feature decoding, adversarial sample generation, and dynamic behavior verification. The generator generates highly realistic code variants under the dual constraints of grammatical rules and global features. The discriminator selects valid samples based on behavioral sequence similarity. The multimodal training sample set provides data support for subsequent cross-modal feature alignment. The collaborative feedback mechanism of generative adversarial networks and federated learning improves the semantic consistency and model robustness of sample generation while protecting data security, laying a data foundation for detecting complex vulnerability patterns.

[0051] Step S103: Input the multimodal training sample into a multi-head cross attention mechanism to extract cross-modal correlation features between function call nodes, text entity embedding vectors, and dynamic event sequence codes in the code structure diagram to generate a fusion feature vector.

[0052] When the multimodal training samples are fed into the multi-headed cross-attention mechanism, graph embedding is first performed on the function call nodes in the code structure graph, converting them into high-dimensional vector representations. The embedding vectors of the function call nodes are then processed using a graph convolutional network to extract hierarchical control flow features, characterizing the calling relationships and data transfer paths between functions. The text entity embedding vector uses a pre-trained language model to semantically encode code comments, API documentation, and vulnerability description text, generating contextual semantic features associated with the code logic. Dynamic event sequence encoding uses a temporal convolutional network to extract multi-scale temporal patterns of runtime behavior, capturing the periodic patterns of abnormal memory operations or system calls.

[0053] The multi-head cross-attention mechanism constructs multiple independent attention subspaces in parallel, and each subspace calculates the interaction weights between different modal features. In the attention subspace of code structure and dynamic behavior, vector dot product operations are used to quantify the correlation strength between function call nodes and dynamic event sequences. For example, the temporal coupling relationship between specific loop structures and memory out-of-bounds operations is identified. In the subspace of text semantics and code structure, the cosine similarity between code node embedding vectors and text entity description vectors is calculated to align the potential correlation between code logic and document semantics. After normalization, the attention weight matrices of each subspace are spliced to form a cross-modal correlation feature map, reflecting the multi-dimensional interaction patterns of code syntax, dynamic behavior, and text description.

[0054] The cross-modal correlation feature map is input into the hierarchical attention interaction module for feature fusion. The first-level attention layer aggregates the correlation features between code structure nodes and dynamic event sequences, screening for highly weighted code-behavior interaction patterns, such as the association path between function calls with unchecked input parameters and subsequent buffer overflow events. The second-level attention layer interacts the aggregation results with textual semantic features to enhance the semantic consistency between code logic and vulnerability description keywords, such as associating high-risk function names with risk keywords in the vulnerability database. Residual connections are used in the hierarchical fusion process to preserve the original modal features, preventing the loss of key information, and ultimately generating a fused feature vector that represents the multi-dimensional characteristics of the vulnerability.

[0055] The fused feature vector is used as a unified multimodal representation and fed into a subsequent graph attention network to quantify node risks in the supply chain dependency graph. Code-behavior interaction patterns extracted from cross-modal correlation features are used to modify edge weight parameters in the dependency graph, and text semantic alignment features assist in identifying potential risk keywords in dependent component descriptions. The synergistic effect of the multi-head cross-attention mechanism and layered fusion bridges the modal gap between code syntax, dynamic behavior, and text semantics, providing semantically consistent multi-dimensional feature input for dependency chain vulnerability propagation analysis and supporting the precise location of complex vulnerability patterns.

[0056] The above steps build a cross-modal alignment chain through graph embedding, multi-subspace attention calculation, and hierarchical feature fusion. The feature interaction mechanism of code structure, dynamic behavior, and text semantics overcomes the limitations of single-modal analysis. The integration of feature vector generation logic and subsequent graph analysis forms a closed technical loop from multimodal alignment to dependency risk quantification, improving the vulnerability detection model's ability to detect hidden vulnerabilities and its adaptability across different ecosystems.

[0057] Step S104: Based on the dependency component metadata, a supply chain dependency graph is constructed using a graph attention network to quantify the probability of vulnerability propagation between components. The fused feature vector is input into the graph attention network to identify high-risk dependency paths associated with code structure nodes in the dependency graph.

[0058] When constructing a supply chain dependency graph based on dependent component metadata, component version information and vulnerability disclosure records are first parsed. The version number, maintenance status, and historical vulnerability data of third-party libraries are then mapped to risk attributes for graph nodes. Call relationships between components are established as directed edges through dependency declarations in the project configuration file. Initial edge weights are dynamically assigned based on the frequency of interface calls and component compatibility declarations. A graph attention network enhances the features of node risk attributes and quantifies the inherent risk level by combining them with CVSS scores from the vulnerability database. For example, nodes with obsolete component versions that have not been updated for a long time are assigned a higher initial risk weight.

[0059] The graph attention network uses a hierarchical attention mechanism to calculate the probability of vulnerability propagation between nodes. The first-level attention layer aggregates the risk characteristics of adjacent nodes and propagates the vulnerability's impact along the dependency chain through a message-passing mechanism. The second-level attention layer introduces a cross-modal fusion feature vector, linking the control flow characteristics of code structure nodes with the risk attributes of dependent components. This calculates the semantic coupling strength between specific function call nodes and high-risk component nodes. Attention weights are normalized to generate the reachability probability of the multi-layer dependency chain, characterizing the potential path for vulnerability propagation from underlying dependent components to core code modules.

[0060] After merging feature vectors and inputting them into the graph attention network, a feature projection mechanism maps cross-modal correlation features to the edge weight space of the dependency graph. The interactive features between code structure nodes and dynamic behavior sequences are used to modify the call frequency weights of dependency edges, for example, identifying interface dependency paths that are frequently called but carry memory out-of-bounds risks. The correlation strength between textual semantic features and vulnerability description keywords is used to synchronously adjust node risk scores, enhancing the ability to perceive implicit risks within documents. The dynamic adjustment of edge weights and node risks leads to topological optimization of the dependency graph, accurately quantifying the probability gradient of vulnerability propagation between components.

[0061] Identification of high-risk dependency paths is based on a combined screening of reachability probability thresholds and cross-modal attention weights. The graph attention network traverses all possible propagation paths in the dependency graph and marks paths with reachability probabilities exceeding a preset threshold as high-risk candidates. Furthermore, the semantic coupling strength between code nodes and dependent components in the fusion feature vectors serves as an auxiliary criterion to screen dependency chains strongly associated with core business logic. For example, it identifies paths that affect the main program entry module through initialization function call chains of high-risk third-party libraries, and verifies their propagation feasibility by combining historical vulnerability data.

[0062] The above steps enable dynamic analysis of risk paths through dependency graph construction, propagation probability quantification, and feature vector fusion. Multi-level enhancement of node risk attributes and projection correction of cross-modal features overcome the static limitations of traditional dependency chain analysis. A joint screening mechanism combining reachability probability and semantic coupling strength supports the precise location of critical vulnerability propagation paths in complex supply chain scenarios, providing a topological basis for subsequent dynamic scanning strategies using reinforcement learning.

[0063] In step S105, a differentiable reinforcement learning framework is used to perform serialized scanning on the target code based on the vulnerability propagation probability of the high-risk dependency path and the attention weight of the cross-modal association feature, dynamically adjust the vulnerability location threshold strategy, and output the vulnerability code segment and the associated dependency chain.

[0064] Using a differentiable reinforcement learning framework, a state space is first constructed based on the vulnerability propagation probability of high-risk dependency paths and the attention weights of cross-modal correlation features. This state space integrates the code context semantic vector, historical false positive statistics, and dependency risk scores to form a multi-dimensional input feature. The code context semantic vector is extracted through a multi-head cross-attention mechanism, representing the comprehensive characteristics of the target code segment's grammatical structure, dynamic behavior patterns, and textual description semantics. Historical false positive statistics extract the distribution of false positive cases from system logs, quantifying the correlation between false positive frequencies and detection rules in different code modules. The dependency risk score is dynamically updated based on the reachability probability calculated by the graph attention network, reflecting the real-time assessment of vulnerability propagation risk in the dependency chain.

[0065] When setting the reward function, a multi-objective weighted strategy is used to balance vulnerability localization accuracy and false alarm suppression effectiveness. Localization accuracy is calculated by calculating the gain value through the recall and precision of the labeled vulnerability samples, while the false alarm suppression effectiveness generates a penalty term based on historical false alarm statistics. The reward function uses the difference between the recall gain and the false alarm penalty as the optimization direction, and adjusts the sensitivity threshold in different scenarios through a dynamic weight allocation mechanism. For example, when the dependency risk score is high and the cross-modal attention weight is concentrated on a specific code area, the recall weight coefficient is increased to strengthen the scanning intensity of high-risk areas; when historical false alarm data shows that a certain type of code pattern frequently triggers false alarms, the false alarm penalty weight of the corresponding area is increased to suppress over-detection.

[0066] When optimizing the state-space localization threshold decision parameters using a policy gradient algorithm, the multidimensional features of the state space are mapped into a set of candidate thresholds, and the policy gradient is calculated based on the reward function's evaluation signal. The localization threshold parameters control the granularity of scanning different code regions. For example, low-threshold, high-sensitivity detection is enabled for modules associated with high-risk dependency paths, while high-threshold detection is applied to low-risk areas to reduce computational overhead. Monte Carlo sampling explores the decision-making effects of different threshold combinations, and gradient ascent is used to update the parameters, ensuring that the high-reward threshold policy has a higher probability of being selected, gradually converging to the optimal parameter distribution.

[0067] When vulnerability location results are output, dynamic scanning strategies are combined to filter out high-risk code segments and associated dependency chains. During the serialized scan process, fine-grained detection is prioritized for code associated with dependency paths whose accessibility probability exceeds a preset threshold, extracting lines of code and call stack information that may indicate a vulnerability. The associated dependency chain traces the propagation path in the dependency graph to generate a complete call chain from the underlying high-risk component to the target code module. For example, this can identify the specific path that triggers a memory leak in the main program through a third-party library initialization function.

[0068] The localization results are fed back into the graph attention network via a gradient backpropagation mechanism, forming a closed-loop optimization loop. For code segments identified as vulnerable, the risk score of the corresponding graph node is enhanced based on the actual propagation of their associated dependency paths. For false positives, the risk weight of the associated node is lowered based on the degree of deviation between the code context semantics and the dependency chain. The updated node features are re-input into the graph attention network for edge weight correction, enabling dynamic, collaborative iteration of the dependency graph risk quantification model and the reinforcement learning localization strategy, enhancing adaptive detection capabilities in complex supply chain environments.

[0069] The above steps form a closed technical loop through state space construction, reward mechanism design, strategy optimization, and closed-loop feedback. Multi-dimensional feature fusion provides a decision basis for reinforcement learning, dynamic threshold adjustment balances detection efficiency and accuracy, and the result feedback mechanism enables the co-evolution of dependency graphs and localization strategies. The deep integration of the reinforcement learning framework with cross-modal features and graph attention networks overcomes the limitations of traditional static detection rules, enabling precise tracking and real-time response to complex vulnerability propagation paths.

[0070] The method for intelligently locating software supply chain vulnerabilities using multimodal feature fusion provided by the present invention realizes a complete logical closed loop of the technical solution through the following steps: First, multimodal data collection is performed on the target software system, and the code structure data, dependency component metadata, and runtime behavior logs of distributed nodes are encrypted and aggregated using a federated learning framework to generate a cross-node encrypted feature set. In this process, the federated learning framework encrypts the code syntax tree, dependency version information, and runtime memory operation logs uploaded by each node through a secure multi-party computing protocol, aggregates and generates global feature statistics, and avoids the risk of leakage of original data. At the same time, based on the reinforcement learning agent, the frequency of code structure changes and the risk level of dependent components are analyzed, and the data sampling weight of each node is dynamically adjusted. The code features of high-frequency modification modules and the metadata of high-risk dependent components with known vulnerabilities are preferentially collected to improve the coverage and efficiency of data collection.

[0071] When the encrypted feature set is input into a conditional generative adversarial network for data augmentation, the generator network generates code variants that conform to the rules of the abstract syntax tree under the constraints of the code structure parser, while maintaining semantic consistency with the real vulnerability scenario. The discriminator network compares the generated code variants with the dynamic behavior sequences of the real vulnerability samples, and evaluates the authenticity of the generated samples through the similarity of abnormal memory access patterns or system call chains in the dynamic behavior logs. Through iterative optimization of adversarial training between the generator and the discriminator, multimodal training samples including code variants and corresponding dynamic behavior sequences are output, expanding the diversity of training data in small sample scenarios and enhancing the model's robustness to code obfuscation and adversarial attacks.

[0072] The multimodal training samples are then input into a multi-head cross-attention mechanism for cross-modal feature alignment. This mechanism parallelly calculates the association weights between the function call nodes, text entity embedding vectors, and dynamic event sequence encodings in the code structure graph to extract cross-modal consistency features. Specifically, the function call relationship in the code structure graph is converted into a vector representation through graph embedding technology, the text entity description is encoded into a semantic vector through a pre-trained language model, and the dynamic event sequence is extracted through a temporal convolutional network to extract temporal features. The multi-head attention mechanism aligns and fuses features of different modalities in multiple semantic spaces through a hierarchical interaction strategy, generating a fused feature vector that characterizes the multi-dimensional characteristics of the vulnerability, thereby eliminating the semantic gap between code syntax and dynamic behavior.

[0073] When constructing a supply chain dependency graph based on dependent component metadata, the graph attention network dynamically integrates component version information and vulnerability disclosure records to update the risk profiles of graph nodes. An attention weight propagation algorithm quantifies the probability of vulnerability reachability in multi-layer dependency chains and identifies critical propagation paths between components. During this process, the fused feature vector is input into the graph attention network, which associates code structure nodes with high-risk component nodes in the dependency graph. For example, code functions that call high-risk third-party libraries are identified, thereby locating critical paths in the dependency chain that may cause vulnerability propagation.

[0074] When using a differentiable reinforcement learning framework for vulnerability localization, a state space consisting of code context semantics, historical false positive statistics, and dependency risk scores is constructed based on the vulnerability propagation probability of the high-risk dependency path and the attention weight of the cross-modal correlation features. A reward function is set to evaluate the balance between positioning accuracy and false positive suppression effect, and the vulnerability detection threshold is dynamically adjusted through a policy gradient algorithm. For example, when the dependency path risk score is high and the cross-modal attention weight is concentrated on a specific code segment, the reinforcement learning agent prioritizes scanning that area, optimizes the localization strategy based on historical false positive data, and ultimately outputs the vulnerable code segment and its associated dependency chain, achieving a precise mapping from global dependency analysis to local code localization.

[0075] The above steps form a closed loop through a collaborative mechanism of data flow and model training: federated learning ensures the secure aggregation of multi-source data, generative adversarial networks improve sample diversity, multi-head attention mechanisms enable cross-modal feature alignment, graph attention networks quantify dependency risk, and a reinforcement learning framework dynamically optimizes localization strategies. The outputs of each step serve as inputs for subsequent steps, such as encrypted feature sets driving data augmentation, fused feature vectors supporting dependency graph analysis, and dependency risk scores guiding reinforcement learning decisions. Ultimately, this improves vulnerability localization accuracy and interpretability in complex supply chain environments.

[0076] Specifically, the multimodal feature fusion software supply chain vulnerability intelligent location method described in the present invention includes the following steps: encrypting and aggregating the code structure data, dependency component metadata, and runtime behavior logs through a secure multi-party computing protocol to generate global feature statistics;

[0077] Based on the reinforcement learning agent, the change frequency of the code structure data and the risk level of the dependent component metadata are analyzed, and the data sampling weight of each distributed node is dynamically adjusted to prioritize the collection of code features of frequently changed modules and version metadata of high-risk dependent components.

[0078] The operational process of the federated learning framework described in this invention is implemented through the following technical solution: Code structure data, dependency component metadata, and runtime behavior logs from each distributed node are encrypted and aggregated using a secure multi-party computation protocol. A homomorphic encryption algorithm is then used to encrypt and transmit the code syntax tree feature vectors, dependency version hash values, and runtime memory access sequences. A weighted averaging operation is then performed on the central aggregation server in a ciphertext state to generate global feature statistics. This process replaces raw data exchange with encrypted intermediate parameters, preventing the leakage of sensitive information in the code repository while maintaining semantic consistency of features across nodes.

[0079] Based on the generation of global feature statistics, the reinforcement learning agent analyzes module activity indicators based on the frequency of code structure data changes, and combines this with the risk level assessment results of dependent component metadata to construct a dynamic sampling strategy. Specifically, the code change frequency is calculated by counting the number of function-level modifications using the commit records of the version control system, and the dependency risk level is quantified based on the CVSS score of the vulnerability database to determine the threat level of the component. The reinforcement learning agent uses module activity and threat level as state inputs and optimizes the node sampling weight distribution strategy through the Q-learning algorithm. This prioritizes the collection of code features of frequently modified modules and the version metadata of high-risk dependent components, thereby improving data collection coverage efficiency and risk focus.

[0080] In these operations, the secure multi-party computation protocol and reinforcement learning strategies form a synergistic mechanism: encrypted aggregation ensures the security of multi-source data, and global feature statistics reflect the distribution patterns of data across nodes. The reinforcement learning agent dynamically optimizes the sampling strategy based on global features, guiding subsequent data collection to focus on high-risk areas. Data collection and strategy optimization form a closed-loop feedback loop. When a newly disclosed dependency component vulnerability is detected, the reinforcement learning agent automatically increases the sampling weight of the associated nodes, triggering targeted supplemental data collection, and dynamically responding to changes in supply chain risks.

[0081] Specifically, the multimodal feature fusion software supply chain vulnerability intelligent location method described in the present invention comprises the following steps: inputting global feature statistics generated by the federated learning framework into a generator network, and constraining the generated code variants to conform to abstract syntax tree rules through a code structure parser;

[0082] The generated code variants and dynamic behavior sequences are input into the discriminator network, and the generator network is iteratively optimized to generate semantically consistent multimodal training samples.

[0083] The operation process of the conditional generative adversarial network described in the present invention is realized by the following technical solution: when the global feature statistics generated by the federated learning framework are input into the generator network, the generator network has a built-in code structure parser to decode and reconstruct the input encrypted feature set. The code structure parser parses the code syntax features based on the abstract syntax tree rules, and constrains the code variants output by the generator to conform to the basic syntax structure of the programming language, such as function definition integrity, variable scope legitimacy, and control flow closure, to avoid generating invalid code fragments that cannot be compiled or executed. Under the grammatical constraints, the generator network combines the cross-node code pattern features in the global feature statistics to generate code variants with potential vulnerability semantics, such as functions with unchecked input parameters or loop structures with memory out-of-bounds risks.

[0084] The generated code variants and the dynamic behavior sequences of real vulnerability samples are fed into the discriminator network for adversarial training. The dynamic behavior sequences collect abnormal system call chains, memory access patterns, and inter-process communication features triggered by real vulnerabilities through runtime probes, forming a multi-dimensional temporal behavior vector. The discriminator network uses a temporal convolutional layer to extract the dynamic behavior temporal features of the code variants and real samples, calculating the difference scores between the two in terms of memory operation frequency, system call path similarity, and abnormal event density. An adversarial loss function is constructed based on the difference scores, and the generator network parameters are iteratively optimized through gradient backpropagation, forcing the generator to produce code variants whose dynamic behavior features closely match those of real vulnerability samples, thereby improving the semantic authenticity of the generated samples.

[0085] During the adversarial training of the generator and discriminator, the generated samples are subject to dual constraints, namely, grammatical compliance and behavioral authenticity. A code structure parser ensures the basic grammatical correctness of the generated code, preventing adversarial training from falling into local noise optimization. Dynamic behavioral similarity constraints guide the generator in learning key behavioral patterns that trigger vulnerabilities, such as repeated out-of-bounds accesses to specific memory addresses or sequences of abnormal system calls. After each training iteration, code variants output by the generator are added as new samples to the multimodal training set, participating in subsequent feature fusion and model training alongside real samples, enhancing the model's robustness to code variants and adversarial attacks.

[0086] In the above operations, the global feature statistics of federated learning provide the generative adversarial network with prior knowledge of code patterns across nodes, guiding the generator to focus on feature generation for high-frequency vulnerability patterns. The discriminator establishes consistency assessment criteria for vulnerability semantics through dynamic behavior comparison, forming a closed-loop optimization mechanism for data augmentation. The synergy between generative adversarial networks and federated learning is reflected in the following: federated learning ensures feature sharing under the security of multi-source data, while the generative adversarial network utilizes shared features to generate diverse training samples. Together, they address the problems of model overfitting and insufficient generalization in small sample size scenarios.

[0087] Specifically, the multi-modal feature fusion software supply chain vulnerability intelligent location method described in the present invention includes the following steps: based on the fused feature vector, parallel calculation of the cross-modal association weights between the function call nodes in the code structure graph and the component nodes in the supply chain dependency graph;

[0088] The embedding vectors of the code structure nodes, the text entity description encoding and the dynamic event sequence features are subjected to hierarchical attention interaction to generate a cross-modal consistent feature representation.

[0089] The operational process of the multi-head cross-attention mechanism described in the present invention is implemented through the following technical solutions: based on the generated fusion feature vector, when calculating the cross-modal association weights of the function call nodes in the code structure graph and the component nodes in the supply chain dependency graph, the graph embedding technology is used to map the function call relationship in the code structure graph into a vector space representation, and at the same time, the risk propagation characteristics of the components in the dependency graph are extracted through the graph attention network. The cross-modal correlation between the function call node vector and the dependent component node vector is calculated by vector dot product and cosine similarity to generate an attention weight matrix that reflects the degree of coupling between the code logic and the dependency risk. This weight matrix is used to identify the potential impact areas of high-risk dependency paths on the code structure, such as the entry function that calls a high-risk third-party library or the interface module with the risk of vulnerability propagation.

[0090] A hierarchical multi-head attention subspace is designed to perform hierarchical attention interactions between the embedding vectors of code structure nodes, text entity description encodings, and dynamic event sequence features. The code structure node embedding vectors are processed through a graph convolutional network to extract function-level control flow features. The text entity description encodings are converted into semantic vectors using a pre-trained language model. Dynamic event sequence features use a time sliding window to capture abnormal behavior temporal patterns. Each attention head independently calculates the interaction weights of different modal features within the subspace, and the multi-level feature interaction results are aggregated through concatenation and normalization operations. The hierarchical attention mechanism prioritizes the association features between code structure nodes and high-risk dynamic event sequences, such as the temporal correlation between memory out-of-bounds operations and specific function calls, while suppressing interference from non-critical annotation information in the text descriptions.

[0091] In this operation, cross-modal correlation weight calculation and hierarchical attention interaction form a synergistic mechanism: the correlation weight matrix provides a basis for cross-modal semantic alignment for hierarchical attention, guiding different attention heads to focus on key areas of interaction between code logic and dependency risks. The cross-modal consistency features output by the hierarchical interaction indicate the direction for further optimizing the update of the correlation weight matrix, for example, increasing the intensity of attention distribution from high-risk dependent components to associated code nodes. This mechanism aligns and fuses the multimodal features of code structure, dependency graph, and dynamic behavior in the semantic space, providing a unified multi-dimensional feature input for subsequent vulnerability propagation path analysis, eliminating the localized and one-sided flaws of single-modality analysis.

[0092] Specifically, the multimodal feature fusion software supply chain vulnerability intelligent positioning method described in the present invention, the graph attention network includes: updating the node risk characteristics of the supply chain dependency graph based on the version information and vulnerability disclosure records of the dependent component metadata; calculating the reachability probability of the vulnerability in the multi-layer dependency chain through the attention weight propagation algorithm, and using the reachability probability as the positioning strategy input parameter of the differentiable reinforcement learning framework.

[0093] The operational process of the graph attention network described in the present invention is implemented through the following technical solutions: When updating the node risk characteristics of the supply chain dependency graph based on the metadata version information and vulnerability disclosure records of dependent components, the release time, maintenance status, and compatibility statement in the component version information are parsed, and the inherent risk level of the component node is quantified by combining the CVE number and CVSS score in the vulnerability disclosure record. For example, abandoned versions of components that have not been updated for a long time are assigned a higher risk weight based on the frequency of vulnerability disclosures, and component versions with known high-risk vulnerabilities are superimposed with a risk coefficient based on the CVSS score. The node risk characteristics are mapped into multidimensional vectors through graph embedding technology, and the node attributes in the dependency graph are dynamically updated to reflect the real-time security status of the supply chain components.

[0094] When calculating the accessibility probability of a vulnerability in a multi-layer dependency chain using the attention weight propagation algorithm, the message passing method of the graph attention mechanism is used to aggregate the risk characteristics of adjacent nodes along the edge connection direction of the dependency graph. For each node on the dependency path, the attention weight between it and the upstream root node is calculated, and the path reachability probability is generated after normalization using the softmax function. This probability represents the possibility of the vulnerability propagating from the underlying dependency components of the supply chain to the target code module. For example, the probability of a high-risk third-party library affecting the main program entry function through a multi-level dependency call chain. During the reachability probability calculation process, the edge weights of the dependency graph are dynamically adjusted based on the call frequency and interface complexity between components, prioritizing dependency paths with high frequency of calls and high interface coupling.

[0095] When the accessibility probability is used as the input parameter of the positioning strategy of the differentiable reinforcement learning framework, the reinforcement learning agent performs a weighted fusion of the accessibility probability and the attention weight of the cross-modal correlation feature to construct a decision basis for vulnerability positioning. For example, when the cross-modal attention weight of a code module is high and the accessibility probability of the associated dependency path exceeds the preset threshold, the reinforcement learning agent prioritizes fine-grained scanning of the module. During the positioning process, the accessibility probability affects the parameter update direction of the graph attention network through the gradient feedback mechanism. For example, when the positioning result feedback shows that the actual vulnerability propagation risk of a dependency path is lower than the estimate, the accessibility probability weight of the corresponding path is automatically lowered, forming a dynamic collaborative optimization of dependency graph risk quantification and positioning strategy.

[0096] In this process, node risk signature updates and reachability probability calculations form a hierarchical analysis structure: the inherent risk of dependent components provides the fundamental attributes for reachability propagation, while the graph attention mechanism quantifies the risk diffusion path through topological analysis. A reinforcement learning framework integrates reachability probabilities with multimodal features to drive dynamic optimization of the positioning strategy. Simultaneously, the positioning results inversely optimize the risk signatures of graph nodes, achieving a closed-loop feedback loop from dependency risk analysis to vulnerability location and graph update. This mechanism effectively addresses the inadequacy of traditional methods in assessing risk propagation deep within dependency chains, improving the accuracy of vulnerability tracing and location in complex supply chain scenarios.

[0097] Specifically, the multimodal feature fusion software supply chain vulnerability intelligent location method described in the present invention includes the following: based on the vulnerability propagation probability of the high-risk dependency path and the attention weight of the cross-modal correlation feature, a state space including a code context semantic vector, historical false positive statistics, and dependency risk score is constructed;

[0098] A reward function is set to evaluate the balance between vulnerability localization accuracy and false alarm suppression effect, and the localization threshold decision parameters in the state space are optimized through a policy gradient algorithm.

[0099] The operational process of the differentiable reinforcement learning framework described in the present invention is implemented through the following technical solutions: when constructing the state space based on the vulnerability propagation probability of high-risk dependency paths and the attention weights of cross-modal correlation features, the code context semantic vector is generated by the fusion feature vector extracted by the multi-head cross-attention mechanism, which characterizes the comprehensive features of the grammatical structure, text description semantics and dynamic behavior pattern of the target code segment. The historical false alarm statistics are feature extracted through the false alarm cases recorded in the system log to quantify the correlation between the false alarm frequency of different code modules and the vulnerability detection rules. The dependency risk score is dynamically adjusted according to the reachability probability calculated by the graph attention network, reflecting the real-time assessment results of the vulnerability propagation risk in the dependency path. The state space integrates the above-mentioned multi-dimensional features to form the input benchmark for vulnerability location decision-making.

[0100] A weighted multi-objective optimization strategy is used to set a reward function to evaluate the balance between vulnerability localization accuracy and false alarm suppression effectiveness. Localization accuracy is calculated by calculating recall and precision based on the detection results of labeled vulnerability samples, while false alarm suppression effectiveness generates a penalty term based on the patterns in historical false alarm statistics. The reward function uses the difference between the localization accuracy gain and the false alarm penalty term as the optimization direction, balancing detection sensitivity and false alarm control requirements through a dynamic weight allocation mechanism. For example, when the dependency risk score is high and the cross-modal attention weight is concentrated on a specific code area, the recall weight coefficient is increased to strengthen the scanning intensity of high-risk areas. When historical false alarm statistics show that a certain type of code pattern frequently triggers false alarms, the false alarm penalty weight of the corresponding area is increased to suppress over-detection.

[0101] When optimizing the localization threshold decision parameters in the state space using a policy gradient algorithm, the multidimensional features in the state space are mapped into a set of candidate localization thresholds, and the policy gradient is calculated based on the evaluation signal output by the reward function. The localization threshold decision parameters control the granularity priority of scanning different code regions. For example, a low threshold with high sensitivity is used for code modules with high-risk dependency paths, while a high threshold is applied to low-risk areas to reduce computational overhead. The policy gradient algorithm explores the decision effects of threshold combinations through Monte Carlo sampling and updates the parameters using gradient ascent, ensuring that the high-reward threshold policy has a higher probability of being selected, gradually converging to the optimal decision parameter distribution.

[0102] In the above operations, state space construction and reward function design form the data foundation for decision optimization: multi-dimensional feature fusion reflects the complex working conditions of vulnerability detection, and the reward mechanism defines the directional constraints of the optimization goal. The policy gradient algorithm achieves an end-to-end association between threshold parameters and detection results through a differentiable mechanism, enabling the localization strategy to adapt to code changes and dependency risk changes. The synergy between the reinforcement learning framework, graph attention network, and multi-head cross-attention mechanism is reflected in the following: dependency risk scores and cross-modal attention weights drive the dynamic reorganization of state space features, and the localization threshold decision results inversely trigger update requests for dependency graph node features, forming a closed-loop iterative optimization of detection strategy and risk perception, improving the adaptive capabilities of vulnerability localization in complex supply chain environments.

[0103] Specifically, the multimodal feature fusion method for intelligently locating software supply chain vulnerabilities described in the present invention also includes: using the generated global feature statistics as the generator input of the conditional generative adversarial network, constraining the semantic consistency of the generated code variants with the global feature statistics; comparing the dynamic behavior sequences of the generated adversarial samples with the real vulnerability samples through the discriminator network, and transmitting the discrimination results back to the federated learning node to optimize the code structure feature extraction rules of the distributed nodes.

[0104] The operational process of the generative adversarial network and federated learning in the present invention is realized by the following technical solution: when the global feature statistics generated by the federated learning framework are input into the generator network, the generator network restores the encrypted aggregated statistics into parsable code semantic features through the feature decoder. The code structure parser performs syntax verification on the code variants output by the generator based on the abstract syntax tree rules, constrains the legality of the variable scope and the closure of the control flow, so that the generated code variants inherit the cross-node vulnerability pattern characteristics in the global feature statistics while maintaining grammatical correctness. For example, the function call pattern with missing permissions that appears frequently in the global features will guide the generator to prioritize the construction of similar function structures in the code variants, while avoiding invalid code generation through syntax verification.

[0105] When the dynamic behavior sequences of generated code variants and real vulnerability samples are fed into the discriminator network for adversarial training, the dynamic behavior sequences collect abnormal memory access traces and system call chains through runtime probes, forming a multi-dimensional temporal feature vector. The discriminator network uses a temporal convolutional layer to extract behavioral pattern characteristics during the execution of the code variants and calculates the difference scores between them and the real samples in terms of memory operation frequency, abnormal signal triggering interval, and system call path similarity. The difference scores are converted into gradient signals through an adversarial loss function, driving the generator network to adjust the semantic generation strategy of the code variants, gradually narrowing the behavioral feature differences between the generated samples and the real vulnerability scenarios.

[0106] The output of the discriminator network is fed back to the federated learning node via a gradient backpropagation mechanism to optimize the distributed node's feature extraction rules. Specifically, the behavioral differences between the generated and real samples identified in the discriminant results serve as reinforcement signals to guide the federated learning node in adjusting the focus dimensions of the local feature extractor. For example, when the discriminator detects that the generated samples differ significantly from the real samples in terms of memory out-of-bounds behavior, the federated learning node will increase the parsing weight of the memory operation mode in the local code structure feature extractor, improving the ability of subsequent encrypted aggregate features to characterize memory security vulnerabilities.

[0107] In this process, generative adversarial networks and federated learning form a two-way optimization mechanism: the global feature statistics provided by federated learning guide the generator in capturing cross-node vulnerability patterns and generating samples to expand the diversity of training data; the discriminator compares the results and inversely optimizes the feature extraction rules of the federated learning nodes, improving the accuracy of vulnerability characterization using subsequent global features. This collaborative mechanism achieves a spiral optimization of data generation and feature extraction through iterative training. While protecting data security, it effectively addresses the problem of insufficient model generalization in small sample scenarios and enhances the robustness of polymorphic vulnerability detection in complex supply chain environments.

[0108] Specifically, the multimodal feature fusion method for intelligently locating software supply chain vulnerabilities described in this invention uses a multi-head cross-attention mechanism and a graph attention network to collaboratively perform the following operations: The component risk probability calculated by the graph attention network is used as a weight constraint for the multi-head cross-attention mechanism to suppress the interaction of associated features between code structure nodes and low-risk dependency paths;

[0109] The cross-modal consistency feature representation generated by the multi-head cross-attention mechanism is used to correct the edge weight parameters of the supply chain dependency graph and optimize the quantitative accuracy of the vulnerability propagation probability.

[0110] The collaborative operation process of the multi-head cross-attention mechanism and graph attention network described in this invention is achieved through the following technical solution: When the component risk probability calculated by the graph attention network is used as the weight constraint condition of the multi-head cross-attention mechanism, the component version vulnerability score and dependency chain propagation path characteristics are extracted from the dependency graph nodes to generate a risk probability vector. This vector is converted into an attention mask matrix through normalization and applied to the weight calculation process of the multi-head cross-attention mechanism to suppress the intensity of feature interactions between code structure nodes and low-risk dependency paths. For example, the priority of function nodes that call low-risk versions of components in the attention weight allocation is reduced, reducing the interference of irrelevant features on cross-modal alignment.

[0111] When modifying the edge weight parameters of the supply chain dependency graph using cross-modal consistency feature representations generated through a multi-headed cross-attention mechanism, feature projection techniques are used to map the fused cross-modal vectors into the edge feature space of the dependency graph. Based on the projection results, the edge weight coefficients of component call relationships in the dependency graph are adjusted. For example, the weights of dependency paths with historical vulnerability propagation records are increased, while the weights of component call edges with no associated vulnerabilities are decreased. After the edge weights are modified, the probability of vulnerability accessibility in multi-layer dependency chains is recalculated, optimizing the adaptability of the quantitative model of vulnerability propagation paths to multimodal features. For example, this allows for more accurate identification of indirect dependency risk paths hidden through textual descriptions.

[0112] In this operation, the interaction between component risk probabilities and cross-modal features forms a bidirectional optimization mechanism: the risk probabilities provided by the graph attention network constrain the feature alignment direction of the multi-head attention mechanism, reducing noise interference on low-risk paths; cross-modal features feed back into the topological structure analysis of the dependency graph through edge weight correction, improving the contextual awareness of vulnerability propagation probability calculation. This collaborative mechanism achieves a hierarchical fusion of multimodal data on code structure, dependencies, and dynamic behavior. The static topological analysis of the dependency graph and the dynamic semantic perception of cross-modal features mutually enhance each other, addressing the blind spots of traditional methods in detecting hidden dependency chains and cross-language interface vulnerabilities, and improving the comprehensiveness and accuracy of vulnerability propagation path analysis in complex supply chain scenarios.

[0113] Specifically, the multimodal feature fusion software supply chain vulnerability intelligent location method described in the present invention also includes:

[0114] The vulnerability propagation probability of the identified high-risk dependency path is used as the state space prior knowledge of the differentiable reinforcement learning framework to dynamically narrow the scanning scope of the target code;

[0115] Through the vulnerability localization results output by the differentiable reinforcement learning framework, the node risk characteristics of the graph attention network are reversely updated to form a closed-loop optimization that depends on the graph risk score and localization strategy.

[0116] The operational process of dependency graph and reinforcement learning closed-loop optimization described in the present invention is realized by the following technical solution: when the vulnerability propagation probability of the identified high-risk dependency path is used as the state space prior knowledge of the differentiable reinforcement learning framework, feature extraction is performed on the component call chain marked as high-risk in the dependency graph to generate a path reachability probability vector. This vector is spliced with the cross-modal correlation features output by the multi-head cross-attention mechanism to construct a multi-dimensional input feature of the reinforcement learning state space. The scanning range of the target code is dynamically adjusted through the probability threshold screening mechanism. For example, fine-grained scanning is enabled for dependency path-related code modules whose reachability probability exceeds a preset threshold, and sampling detection is used for low-probability path-related areas to optimize the allocation efficiency of computing resources.

[0117] When vulnerability localization results output by a differentiable reinforcement learning framework are used to reversely update the node risk features of the graph attention network, a gradient backpropagation mechanism is used to feed back false positive and false negative signals in the localization results to the dependency graph nodes. Specifically, for code segments identified as vulnerabilities in the localization results, the risk scores of the corresponding path nodes are enhanced based on the actual vulnerability propagation of their associated dependency paths. For false positive cases, the risk probability weights of the relevant nodes are lowered based on the degree of deviation between the code context semantics and the dependency path. The updated node risk features are re-entered into the graph attention network to modify the edge weights of the dependency graph, forming an iterative optimization loop for risk scoring and localization strategies.

[0118] In this process, the interaction between vulnerability propagation probability and localization results forms a two-way optimization mechanism: the dependency graph provides prior knowledge to guide reinforcement learning localization strategy generation, and localization results are fed back through gradients to correct the dependency graph's risk assessment model. Dynamic scanning range adjustment reduces ineffective computational overhead in low-risk areas, and the gradient feedback mechanism continuously optimizes the accuracy of graph node features. This closed-loop design enables the co-evolution of dependency risk quantification and vulnerability localization strategies, adapting to the vulnerability detection needs of the continuously iterating software supply chain and improving the detection rate and efficiency of long-tail vulnerabilities in complex dependency ecosystems.

[0119] Specifically, the multimodal feature fusion software supply chain vulnerability intelligent location method described in the present invention also includes:

[0120] A prototype network is used to cluster vulnerability features of multimodal training samples and construct vulnerability pattern prototype vectors across programming language projects.

[0121] The localization strategy parameters of the differentiable reinforcement learning framework are transferred to a lightweight explanation model through attention distillation technology to generate heat map explanation information corresponding to the vulnerability code segment and the associated dependency chain.

[0122] The collaborative operation process of the prototype network and attention distillation described in the present invention is achieved through the following technical solution: When using the prototype network to cluster vulnerability features of multimodal training samples, the control flow anomaly patterns in the code structure diagram, the timing anomaly features of the dynamic behavior sequence, and the semantic risk keywords in the text description are extracted. The cosine similarity of vulnerability features between projects in different programming languages is calculated through metric learning. Vulnerability features with similarity exceeding a preset threshold are clustered into a unified prototype vector. For example, the prototype vector of a memory safety vulnerability aggregates the pointer misuse features of a C / C++ project and the lifecycle management defect features of a Rust project, forming a universal representation of cross-language vulnerability patterns.

[0123] After constructing a prototype vector of vulnerability patterns across programming language projects, the localization strategy parameters of the differentiable reinforcement learning framework are migrated to a lightweight interpretation model using attention distillation technology. Specifically, the cross-modal attention weight distribution and localization threshold decision rules are extracted from the reinforcement learning framework's policy network and compressed into the classifier parameters of the lightweight model using a knowledge distillation algorithm. The lightweight interpretation model matches vulnerability patterns against the target code segment based on the migrated parameters. When generating heat map interpretation information, the gradient-weighted class activation mapping technology is used to highlight the code lines and associated dependency chain nodes with the highest match to the prototype vector, such as identifying unverified input parameter transfer paths and call locations of high-risk dependent components.

[0124] In this process, prototype networks and attention distillation form a synergistic mechanism for cross-language vulnerability detection and explanation. Prototype vectors provide a cross-project vulnerability pattern benchmark, guiding lightweight models to quickly adapt to detection scenarios in new programming languages. Distillation technology preserves the complex decision-making logic of reinforcement learning and visualizes the correlation paths of key features through heat maps. This mechanism enables interpretable verification of vulnerability location results. Security experts can use heat map annotation feedback to optimize the clustering accuracy of prototype vectors, forming an interactive optimization loop between detection models and expert experience, enhancing the transparency and credibility of vulnerability management across the ecosystem and supply chain.

[0125] The method for intelligently locating software supply chain vulnerabilities with multimodal feature fusion provided by the present invention is realized through the following steps in specific implementation: first, multimodal data collection is performed on the code structure data, dependent component metadata and runtime behavior logs of the target software system, and the data of the distributed nodes is encrypted and aggregated using a federated learning framework. Specifically, the code syntax tree features, dependent version hash values and runtime memory access sequences are homomorphically encrypted and transmitted through a secure multi-party computing protocol, and weighted average operations in the ciphertext state are performed on the central server to generate global feature statistics. In this process, the reinforcement learning agent analyzes the frequency of code changes based on the submission records of the version control system, quantifies the risk level of dependent components in combination with the CVSS score, dynamically adjusts the node sampling weights, and prioritizes the collection of code features of high-frequency modification modules and metadata of high-risk dependent components, thereby improving data collection efficiency and risk focus capabilities.

[0126] When the encrypted feature set is fed into a conditional generative adversarial network for data augmentation, the generator network, constrained by the code structure parser, generates code variants that conform to the rules of the abstract syntax tree. For example, these variants may construct functions with unvalidated input parameters or loop structures that pose a memory out-of-bounds risk. The discriminator network compares the generated code variants with the dynamic behavior sequences of real vulnerability samples. Using a temporal convolutional layer, it extracts differences in timing features such as memory operation frequency and system call path similarity. It then constructs an adversarial loss function to iteratively optimize the generation strategy and output semantically consistent multimodal training samples. The generated samples participate in subsequent training alongside real data, enhancing the model's robustness against code obfuscation and adversarial attacks.

[0127] The multimodal training samples are fed into a multi-headed cross-attention mechanism for cross-modal feature alignment. Graph embedding technology is used to convert function call relationships in the code structure graph into vector representations. A pre-trained language model is used to encode text semantic features, and a temporal convolutional network is used to extract dynamic event sequence features. The hierarchical attention mechanism calculates the interaction weights of code nodes, dependent components, and dynamic behaviors in multiple subspaces, suppressing noise interference in low-risk paths and generating a fused feature vector. This vector is fed into a graph attention network to construct a supply chain dependency graph, dynamically integrating component version information and vulnerability disclosure records to update node risk features. The attention weight propagation algorithm is used to quantify the probability of vulnerability accessibility in multi-layer dependency chains, for example, identifying the propagation path of high-risk third-party libraries affecting the main program entry through multi-level call chains.

[0128] When using a differentiable reinforcement learning framework for vulnerability localization, a state space is constructed based on reachability probabilities and cross-modal attention weights, integrating code context semantics, historical false positive statistics, and dependency risk scores. A reward function is set to balance localization accuracy and false positive suppression effectiveness. The scanning threshold is dynamically adjusted using a policy gradient algorithm, prioritizing fine-grained detection for code modules associated with high-risk dependency paths. Localization results are fed back to the graph attention network via a gradient backpropagation mechanism, which corrects node risk scores and edge weight parameters, forming a closed loop of "risk quantification-localization-graph update." For example, when a false positive case indicates an inflated risk score for a dependency path, its weight is automatically lowered and the graph topology is updated to improve subsequent detection accuracy.

[0129] Furthermore, a prototype network is used to cluster vulnerability features across languages in multimodal training samples. For example, common features between C / C++ pointer misuse and Rust lifecycle defects are aggregated to construct prototype vectors of vulnerability patterns across programming languages. Attention distillation technology is used to migrate reinforcement learning positioning strategy parameters to a lightweight interpretation model, generating heatmap interpretation information that highlights high-risk code segments and associated dependency chain nodes, assisting security experts in verification and model optimization. These steps, through a collaborative mechanism of data collection, feature fusion, dependency analysis, and dynamic decision-making, enable the precise location and cross-ecosystem generalization of complex supply chain vulnerabilities while protecting data security.

[0130] Example 1:

[0131] In this embodiment, the federated learning framework uses a secure multi-party computing protocol to encrypt and aggregate the code structure data, dependency component metadata, and runtime behavior logs of distributed nodes. The specific parameters are set as follows:

[0132] Encryption algorithm: Paillier homomorphic encryption algorithm is used to process the code syntax tree feature vector, with a key length of 2048 bits;

[0133] Data aggregation: The central aggregation server performs weighted averaging in the encrypted state, and the weight coefficient is dynamically adjusted to 0.3-0.7 based on the amount of node data;

[0134] Dynamic sampling strategy: Optimize node sampling weights based on the Q-learning algorithm. The code change frequency threshold is set to ≥5 commits per day. The risk level of dependent components is set to CVSS score ≥7.0 as the high-risk threshold.

[0135] Feature Dimensions: The code structure feature vector dimension is 512-dimensional, the dependency metadata hash value length is 256 bits, and the runtime behavior log is encoded as a 128-dimensional time series vector.

[0136] Example 2:

[0137] In this embodiment, the generator network parameters of the conditional generative adversarial network are configured as follows:

[0138] Code structure parser: built based on abstract syntax tree rules, supports syntax verification for languages such as Java / Python / C++, and has a function closure check error tolerance of ≤0.1%;

[0139] Generator architecture: uses a 5-layer Transformer encoder with a hidden layer dimension of 768, and the grammatical compliance rate of the generated code variants is ≥98%;

[0140] Discriminator comparison parameters: Dynamic behavior sequence comparison uses a temporal convolutional layer (kernel size = 5, stride = 2), the cosine similarity threshold is set to 0.85, and the number of adversarial training iterations is 1000 rounds;

[0141] Output samples: The vulnerability semantic matching degree of the generated code variants is ≥ 90%, and the number of samples generated in a single batch is 512.

[0142] Example 3:

[0143] In this embodiment, the specific parameters of the multi-head cross attention mechanism include:

[0144] Number of attention heads: set to 8, with each head having an attention dimension of 64;

[0145] Cross-modal association weight calculation: The vector dot product scaling factor of the code structure node and the dependency graph node is √64, and the association weight threshold is ≥0.6;

[0146] Hierarchical attention interaction: Text entity encoding uses the BERT pre-trained model (Base version), the dynamic event sequence time window size is 10 steps, and the dimension after feature splicing is 1024;

[0147] Fusion feature output: The cross-modal consistency feature vector dimension is 256, and the feature redundancy is reduced to less than 15%.

[0148] Example 4:

[0149] In this embodiment, the parameters of the graph attention network are configured as follows:

[0150] Node risk feature update: The risk weight of nodes with component versions released more than 2 years ago and no maintenance records is increased by 0.3. The risk factor of nodes with a CVSS score ≥ 9.0 is increased by 1.5.

[0151] Reachability probability calculation: The attention propagation algorithm is iterated three times, the initial edge weight is the normalized value of the component call frequency (range 0-1), and the path reachability probability error rate is ≤5%;

[0152] Graph optimization: When projecting cross-modal features into edge weight space, a fully connected layer (dimension 128→64) is used, and the edge weight correction step size is 0.01.

[0153] Example 5:

[0154] In this embodiment, the parameters of the differentiable reinforcement learning framework include:

[0155] State space construction: The code context semantic vector dimension is 256, the historical false alarm statistics span is 30 days, and the dependency risk score dynamic update cycle is 1 hour;

[0156] Reward function design: The recall rate weight coefficient is 0.7, the false alarm penalty coefficient is 0.3, and the positioning accuracy deviation tolerance is ≤ 2%;

[0157] Policy gradient optimization: The number of Monte Carlo sampling is 500, the learning rate is set to 0.001, and the number of iterations for convergence of the positioning threshold decision parameter is 200 rounds;

[0158] Closed-loop feedback: The node risk feature update gradient feedback step size is 0.005, and the response delay of the dependent graph edge weight correction is ≤1 second.

[0159] Example 6:

[0160] In this embodiment, the parameters of the prototype network and attention distillation technology are configured as follows:

[0161] Vulnerability feature clustering: Cosine similarity is used as the metric, the clustering threshold is set to 0.8, and the cross-language vulnerability prototype vector dimension is 128;

[0162] Knowledge distillation: The reinforcement learning strategy network parameter compression rate is 60%, the lightweight explanation model parameter volume is ≤1M, and the heat map generation response time is ≤50ms;

[0163] Interpretability verification: The focus region radius of the gradient-weighted class activation map is set to 3 lines of code, and the ratio of heat map resolution to code lines is 1:1.

[0164] Explanation of the technical features of the present invention:

[0165] Federated Learning Framework:

[0166] Definition: A distributed machine learning paradigm that allows multiple parties to collaborate on training models without the data leaving the local node.

[0167] In the application of the present invention:

[0168] Encrypted aggregation: Through secure multi-party computing protocols (such as Paillier homomorphic encryption), the code structure data (such as abstract syntax tree features), dependency component metadata (version hash values), and runtime behavior logs (memory access sequences) of distributed nodes are encrypted, transmitted, and aggregated to generate global feature statistics (such as 512-dimensional vectors).

[0169] Dynamic Sampling Optimization: Using a reinforcement learning agent (Q-learning algorithm), this algorithm analyzes code change frequency (e.g., daily commits ≥ 5) and the risk level of dependent components (CVSS score ≥ 7.0). It dynamically adjusts node sampling weights (weight coefficient 0.3-0.7), prioritizing data collection for frequently modified modules and high-risk dependent components. This technical benefit addresses multi-source data security issues and improves the targetedness and efficiency of data collection.

[0170] Conditional Generative Adversarial Networks (cGANs):

[0171] Definition: A variant of Generative Adversarial Networks that constrains the semantic properties of generated samples through conditional input. Applications of this invention:

[0172] Generator network: This network takes global feature statistics from federated learning as input and uses a code structure parser (based on abstract syntax tree rules) to generate syntactically compliant code variants (such as functions with unchecked parameters), with a compliance rate of ≥ 98%.

[0173] The discriminator network compares the dynamic behavior sequences of generated code variants with those of real vulnerability samples (such as the system call chain of a memory out-of-bounds operation). It uses a temporal convolutional layer (kernel size = 5) to extract differences in temporal features and optimizes the generation strategy using an adversarial loss function. Technical Effect: This expands small sample training data and enhances the model's robustness against code obfuscation attacks.

[0174] Multi-head cross attention mechanism:

[0175] Definition: An attention mechanism that parallelizes the weights of multimodal feature associations, separating interactions in different semantic spaces through a multi-head design. Applications of this invention:

[0176] Cross-modal alignment: Parallel calculation of the association weights (threshold ≥ 0.6) of function call nodes (graph embedding vectors) in the code structure graph, component nodes (risk probability vectors) in the dependency graph, and dynamic event sequences (temporal convolutional features) to generate a cross-modal consistent feature representation (256-dimensional vector).

[0177] Layered Interaction: Textual entity descriptions are encoded using the BERT model (768 dimensions). Dynamic event sequences are extracted using a sliding window (10 steps). Multi-head attention (8 heads) is used to hierarchically aggregate features. This technical benefit eliminates the semantic gap between code, text, and behavioral data, reducing redundant feature interference.

[0178] Graph Attention Network (GAT):

[0179] Definition: A graph neural network based on the attention mechanism, used to quantify the strength of associations between nodes. Applications of this invention:

[0180] Node risk update: Dynamically update the dependency graph node risk characteristics (risk weight +0.3) based on component version information (e.g., release time > 2 years without maintenance) and vulnerability disclosure records (CVE number, CVSS score ≥ 9.0).

[0181] Propagation Probability Calculation: This algorithm uses an attention propagation algorithm to iteratively calculate the vulnerability's reachability probability within the dependency chain (with an error rate ≤ 5%). Edge weights are normalized based on call frequency (ranging from 0 to 1). Technical Effect: This method accurately quantifies the vulnerability's cross-component propagation path and supports dependency chain risk analysis.

[0182] Differentiable Reinforcement Learning Framework (DRL):

[0183] Definition: A decision-making framework that combines reinforcement learning and gradient optimization to support end-to-end policy tuning. Applications of this invention:

[0184] State space construction: Fusion of code context semantic vectors (256 dimensions), historical false positive statistics (30-day window), and dependency risk scores to generate multi-dimensional state inputs.

[0185] Dynamic Policy Optimization: The reward function balances recall (weight 0.7) with false positive suppression (weight 0.3). The localization threshold is adjusted using a policy gradient algorithm (learning rate 0.001) (200 iterations of convergence). Technical Effect: Adaptive adjustment of scanning granularity balances detection efficiency and accuracy.

[0186] Prototype Network and Attention Distillation:

[0187] definition:

[0188] Prototype Network: Constructs prototype vectors (128 dimensions) of cross-language vulnerability patterns through clustering, supporting small sample migration.

[0189] Attention distillation: Migrates the decision logic of complex models to lightweight models to generate interpretable heat maps. Applications of this invention:

[0190] Cross-language clustering: Metric learning calculates the cosine similarity (threshold ≥ 0.8) between C / C++ pointer misuse and Rust lifetime defects, and generates a unified prototype vector.

[0191] Heat map generation: Through gradient-weighted class activation mapping (focusing radius 3 lines of code), high-risk code segments and dependency chain nodes (response time ≤ 50ms) are highlighted.

[0192] Technical effect: Improves cross-language generalization capabilities and enhances the interpretability of detection results.

[0193] Federated Learning Framework: This framework securely aggregates multimodal data across distributed nodes. This framework uses a secure multi-party computation protocol to encrypt and transmit code structure data, dependency component metadata, and runtime behavior logs, generating global feature statistics. A dynamic sampling strategy, based on reinforcement learning agents, optimizes node data weights, prioritizing data from frequently modified modules and high-risk dependency components to improve data coverage efficiency. Global feature statistics provide cross-node vulnerability pattern signatures for subsequent models while ensuring data security.

[0194] Conditional Generative Adversarial Network (cGAN): This network consists of a generator and a discriminator. The generator receives global feature statistics from federated learning and generates syntactically compliant code variants under the constraints of a code structure parser. For example, it constructs interfaces with unchecked inputs or memory out-of-bounds structures. The discriminator compares the generated code variants with the dynamic behavior sequences (such as system call chains) of real vulnerability samples, optimizing the semantic authenticity of the generated samples through adversarial training. The generated code variants expand the multimodal training sample, alleviating data scarcity in small sample sizes and enhancing the model's robustness to code obfuscation.

[0195] Multi-head cross-attention mechanism: This mechanism is used to fuse cross-modal features of code structure, text semantics, and dynamic behavior. Code structure nodes are mapped to vectors using graph embedding, text entities are encoded using a pre-trained language model, and temporal features of dynamic event sequences are extracted using temporal convolution. Parallel attention subspaces are used to calculate interaction weights between different modalities, such as the strength of association between code function nodes and abnormal memory operations. Hierarchical attention aggregates multimodal features to generate a unified fusion vector, eliminating semantic gaps and providing multi-dimensional input for dependency graph analysis.

[0196] Graph Attention Network (GAT): Builds a supply chain dependency graph and quantifies vulnerability propagation paths. Node risk attributes are updated based on component version information and vulnerability disclosure records, while edge weights reflect component call frequency and interface complexity. An attention propagation algorithm is used to calculate the reachability probability of vulnerabilities in multi-layer dependency chains. Cross-modal feature fusion is used to modify edge weight parameters and identify high-risk dependency paths (such as call chains of high-risk third-party libraries). This reachability probability serves as an input parameter for reinforcement learning to guide vulnerability location prioritization.

[0197] Differentiable Reinforcement Learning (DRL) framework: Dynamically adjusts vulnerability localization strategies based on the state space. The state space integrates code context, historical false positive statistics, and dependency risk scores. The reward function balances recall and false positive suppression. A policy gradient algorithm optimizes scanning threshold parameters, prioritizing code modules associated with high-risk dependency paths. It outputs vulnerable code segments and complete dependency chains. Localization results are fed back to the graph attention network, forming a closed loop of "risk quantification-localization-graph update," enhancing detection adaptability.

[0198] Prototype Networks and Attention Distillation: Prototype Networks cluster cross-language vulnerability signatures through metric learning, constructing prototype vectors for common vulnerability patterns (e.g., common features of memory safety vulnerabilities). Attention Distillation transfers reinforcement learning policy parameters to a lightweight model, generating heatmaps to explain vulnerable code segments and associated dependency chains, such as highlighting lines of code with unvalidated input parameters. This technology enhances cross-language generalization capabilities and improves the interpretability of detection results through visualization, assisting security experts in verification.

[0199] These models form a collaborative closed loop through multimodal data collection, feature fusion, dependency analysis, and dynamic decision-making. Federated learning ensures data security, generative adversarial networks enhance sample diversity, multi-head attention achieves cross-modal alignment, graph attention networks quantify propagation risk, reinforcement learning optimizes localization strategies, and prototype networks and distillation techniques support cross-language interpretation. The technical integration and feedback mechanisms of these models systematically address the shortcomings of traditional methods in data security, generalization from small samples, dependency chain analysis, and interpretability, enabling the precise location and mitigation of vulnerabilities in complex supply chains.

[0200] The present invention systematically solves the existing technical problems through the following technical solutions:

[0201] In response to the lack of vulnerability characterization dimensions and difficulty in cross-modal fusion caused by single-modal feature analysis, the present invention adopts a federated learning framework to encrypt and aggregate code structure, dependent component metadata, and runtime behavior logs to generate a cross-node encrypted feature set, thereby achieving the protection and preliminary fusion of multi-source heterogeneous data. Through conditional generative adversarial networks, semantically authentic code variants are generated under the constraints of grammatical rules, and the discriminator network is combined to compare the similarity of dynamic behavior sequences and expand multimodal training samples. The multi-head cross-attention mechanism further extracts cross-modal correlation features of code structure nodes, text entity embedding vectors, and dynamic event sequences, eliminates semantic gaps through hierarchical attention interaction, and generates a fused feature vector. The present invention breaks through the limitations of single-modal analysis, reduces redundancy and noise interference through multi-dimensional feature alignment, and improves the comprehensiveness of vulnerability characterization.

[0202] In response to sample scarcity and insufficient cross-language generalization capabilities, this paper introduces a prototype network to cluster vulnerability features of multimodal training samples and construct vulnerability pattern prototype vectors across programming language projects. Through metric learning, the similarity of vulnerability features of projects in different languages is quantified (such as the commonality between C / C++ pointer misuse and Rust lifecycle defects), forming a universal representation of cross-language vulnerabilities. Combined with attention distillation technology, the positioning strategy parameters of the reinforcement learning framework are migrated to a lightweight interpretation model to generate heat map explanation information to guide the model to quickly adapt to new language scenarios. The synergistic mechanism of federated learning and generative adversarial networks guides data enhancement through global feature statistics, improving the model's robustness to noise and cross-ecological generalization capabilities under small sample conditions.

[0203] In response to the insufficient fusion of dependency graphs and multimodal data and the limitations of vulnerability propagation path analysis, the present invention uses a graph attention network to construct a supply chain dependency graph, quantify the probability of vulnerability propagation between components, and input the fused feature vector into the graph analysis module to identify high-risk dependency paths. The differentiable reinforcement learning framework constructs a state space based on propagation probability and cross-modal attention weights, and dynamically adjusts the positioning threshold strategy. Through the gradient backpropagation mechanism, the positioning results are fed back to update the risk characteristics of the dependency graph nodes, forming a "risk quantification-positioning-graph update" closed loop. The present invention breaks through the local correlation limitations of traditional dependency chains, combines multimodal features to dynamically correct edge weight parameters, accurately tracks cross-level vulnerability diffusion paths, and improves positioning accuracy and real-time response capabilities in complex supply chain environments.

Claims

1. The intelligent software supply chain vulnerability location method based on multimodal feature fusion is characterized by: include: Collect multimodal data from the target software system and encrypt and aggregate the code structure data, dependency component metadata, and runtime behavior logs of distributed nodes through a federated learning framework to generate a cross-node encrypted feature set. The encrypted feature set is input into a conditional generative adversarial network, the generator network generates code variants that are semantically consistent with the real vulnerability scenario, and the discriminator network compares the similarity of dynamic behavior sequences to output multimodal training samples; Input the multimodal training samples into a multi-head cross attention mechanism to extract cross-modal correlation features between function call nodes, text entity embedding vectors, and dynamic event sequence encodings in the code structure graph to generate a fused feature vector; Based on the metadata of the dependent components, a supply chain dependency graph is constructed through a graph attention network to quantify the probability of vulnerability propagation between components. The fused feature vector is input into the graph attention network to identify high-risk dependency paths associated with code structure nodes in the dependency graph. Using a differentiable reinforcement learning framework, based on the vulnerability propagation probability of the high-risk dependency path and the attention weight of the cross-modal correlation feature, the target code is serialized and scanned, the vulnerability localization threshold strategy is dynamically adjusted, and the vulnerable code segment and associated dependency chain are output; The conditional generative adversarial network includes: The global feature statistics generated by the federated learning framework are input into the generator network, and the generated code variants are constrained by the code structure parser to conform to the abstract syntax tree rules; The generated code variants and dynamic behavior sequences are input into the discriminator network, and the generator network is iteratively optimized to generate semantically consistent multimodal training samples. The differentiable reinforcement learning framework includes: Based on the vulnerability propagation probability of the high-risk dependency path and the attention weight of the cross-modal correlation feature, a state space including the code context semantic vector, historical false positive statistics and dependency risk score is constructed; A reward function is set to evaluate the balance between vulnerability localization accuracy and false alarm suppression effect, and the localization threshold decision parameters in the state space are optimized through a policy gradient algorithm.

2. The method for intelligently locating software supply chain vulnerabilities based on multimodal feature fusion according to claim 1 is characterized in that: The federated learning framework includes: encrypting and aggregating the code structure data, dependency component metadata, and runtime behavior logs through a secure multi-party computing protocol to generate global feature statistics; Based on the reinforcement learning agent, the change frequency of the code structure data and the risk level of the dependent component metadata are analyzed, and the data sampling weight of each distributed node is dynamically adjusted to prioritize the collection of code features of frequently changed modules and version metadata of high-risk dependent components.

3. The method for intelligently locating software supply chain vulnerabilities based on multimodal feature fusion according to claim 1 is characterized in that: The multi-head cross attention mechanism includes: Based on the fused feature vector, cross-modal association weights of function call nodes in the code structure graph and component nodes in the supply chain dependency graph are calculated in parallel; The embedding vectors of the code structure nodes, the text entity description encoding and the dynamic event sequence features are subjected to hierarchical attention interaction to generate a cross-modal consistent feature representation.

4. The method for intelligently locating software supply chain vulnerabilities based on multimodal feature fusion according to claim 1 is characterized in that: The graph attention network includes: Based on the version information and vulnerability disclosure records of the dependency component metadata, update the node risk characteristics of the supply chain dependency graph; The accessibility probability of vulnerabilities in multi-layer dependency chains is calculated through the attention weight propagation algorithm, and the accessibility probability is used as the input parameter of the localization strategy of the differentiable reinforcement learning framework.

5. The method for intelligently locating software supply chain vulnerabilities based on multimodal feature fusion according to claim 2 is characterized in that: Also includes: Using the generated global feature statistics as the generator input of a conditional generative adversarial network, constraining the generated code variants to be semantically consistent with the global feature statistics; The discriminator network compares the dynamic behavior sequences of the generated adversarial samples with the real vulnerability samples, and transmits the discrimination results back to the federated learning nodes to optimize the code structure feature extraction rules of the distributed nodes.

6. The method for intelligently locating software supply chain vulnerabilities based on multimodal feature fusion according to claim 3 is characterized in that: Also includes: The component risk probability calculated by the graph attention network is used as the weight constraint of the multi-head cross attention mechanism to suppress the interaction between the associated features of code structure nodes and low-risk dependency paths; The cross-modal consistency feature representation generated by the multi-head cross-attention mechanism is used to correct the edge weight parameters of the supply chain dependency graph and optimize the quantitative accuracy of the vulnerability propagation probability.

7. The method for intelligently locating software supply chain vulnerabilities based on multimodal feature fusion according to claim 4 is characterized in that: Also includes: The vulnerability propagation probability of the identified high-risk dependency path is used as the state space prior knowledge of the differentiable reinforcement learning framework to dynamically narrow the scanning scope of the target code; The vulnerability localization results output by the differentiable reinforcement learning framework are used to reversely update the node risk features of the graph attention network.

8. The method for intelligently locating software supply chain vulnerabilities based on multimodal feature fusion according to claim 1 is characterized in that: Also includes: A prototype network is used to cluster vulnerability features of multimodal training samples and construct vulnerability pattern prototype vectors across programming language projects. The localization strategy parameters of the differentiable reinforcement learning framework are transferred to a lightweight explanation model through attention distillation technology to generate heat map explanation information corresponding to the vulnerability code segment and the associated dependency chain.

Images