A vulnerability detection method based on multi-modal joint distillation optimization

Abstract

A vulnerability detection method based on multi-modal joint distillation optimization - mVulD-DO, first generates a key code structure diagram, and extracts function names, variable names and auxiliary representation information from the key code structure diagram, and inputs the code slices into a pre-trained semantic encoder for coding to generate a feature tensor of a semantic mode; in addition, a heterogeneous adjacency matrix is constructed by using the nodes of the key code structure diagram and the edges with different attributes, and the GAT is inputted for coding to generate a feature tensor of a graph structure. The semantic feature tensor is distilled through a multi-head distillation network to obtain corresponding single-peak features, and the long-distance dependence of the code is further extracted through BLSTM to obtain the final semantic auxiliary features. The distribution distance between the graph structure feature space and the semantic auxiliary feature space is calculated by using a dynamic Sinkhorn algorithm, and the features of the optimized modes are further fused and optimized by using a global attention layer to ensure the coordination of the features in the feature space. The present application improves the detection efficiency and the accuracy of vulnerability detection of the model.

Description

Technical Field

[0001] This invention relates to a vulnerability detection method based on multimodal joint distillation optimization. Background Technology

[0002] Traditional rule-based vulnerability detection methods typically rely on predefined rules and vulnerability features from experts, identifying potential vulnerabilities by statically analyzing source code and matching it against a rule base. However, this approach is limited by the finite coverage of the rule base, often failing to effectively detect novel vulnerabilities, and exhibiting a high false positive rate. Machine learning-based vulnerability detection methods automatically learn features from a large number of source code samples for classification, eliminating the need for manually defined vulnerability features. While these methods can handle a wider range of vulnerability types, they require feature extraction from the code, and feature design still relies on domain knowledge, resulting in coarse granularity and insufficient precision. In contrast, deep learning methods can automatically extract complex features from source code through deep networks, avoiding the limitations of manual feature design. Deep learning models can learn more abstract and efficient representations from large amounts of data, thus demonstrating superior performance in vulnerability detection, especially when dealing with large-scale, complex, and diverse vulnerabilities, exhibiting better generalization ability and therefore being widely used in vulnerability detection tasks.

[0003] Among them, Recurrent Neural Networks (RNNs) have become a very important model due to their ability to effectively capture dependencies in time series data. To address the vanishing or exploding gradient problems that RNNs encounter when processing long sequences, researchers have proposed variants of RNNs—Bidirectional Long Short-Term Memory (BLSTM) and Bidirectional Gated Recurrent Units (BGRUs). These two models can handle not only forward temporal dependencies but also backward dependencies, making them more efficient at capturing long-term dependencies and contextual information in the source code. Li et al. (Li Z, Zou D, Xu S, et al. VulDeePecker: A Deep Learning-Based System for Vulnerability Detection[C]. 2018.) and Zou et al. (Zou D, Wang S, Xu S, et al. µVulDeePecker: A Deep Learning-Based System for Multiclass Vulnerability Detection[J], 2019) constructed code snippets using data dependencies and control dependencies, and used a BLSTM model to learn the semantic features of the code snippets. Although these two methods take into account the features of syntax and semantics more comprehensively, they do not take into account the structural features of the code sufficiently. Further research, such as that by Zhou et al. (Zhou, Yaqin, et al. "Devign: Effective vulnerability identification by learning comprehensive program semantics via graph neural networks." Advances in neural information processing systems 32(2019).), has employed graph neural networks (GNNs). By modeling the source code as a graph structure, it can better capture structural information such as control flow and data flow in the source code. Although it considers data dependencies and control dependencies, it does not consider the attributes of nodes and edges, resulting in insufficient capture of semantic information.Subsequently, Wu et al. (Wu, Bolun, et al. "SlicedLocator: Code vulnerabilitylocator based on sliced ​​dependence graph." Computers & Security 134 (2023): 103469.) defined attributes for each edge in the graph structure based on dependencies, considering both sequence features and graph structure features simultaneously. This approach achieved good results in vulnerability detection tasks, but it did not consider higher-level semantic information and did not adequately address the heterogeneity of feature distributions between sequence and graph modalities. Patent CN201910447971 employs program slicing technology, identifying code statements related to candidate vulnerability elements based on the program dependency graph (PDG). However, this method focuses on detecting vulnerabilities in a single function, while vulnerabilities in source code are often not limited to a single function, especially in contexts involving cross-function calls, global variables, etc. Patent CN202110770650 uses the BERT model and BLSTM to detect vulnerabilities in C source code. However, BERT and BiLSTM are based on sequence models and have weak capabilities in capturing graph structure information in source code. Patent CN113868650A discloses a vulnerability detection method based on heterogeneous intermediate graph representation of code, which transforms each syntactic unit (such as statements, functions, variables, etc.) in the source code into nodes and edges in a graph, thereby preserving the structural information of the code. However, this method has difficulty capturing long-distance and cross-function dependencies. Patent CN118296612A proposes a source code vulnerability detection method based on a dual-channel model of sequence and graph. Although this method considers semantic and syntactic information more comprehensively, the fusion of the outputs of the graph model and the sequence model through the fully connected layer is not detailed enough, and it does not take into account the heterogeneity between different modal features. Summary of the Invention

[0004] This invention discloses a multi-modal joint distillation optimization method for vulnerability detection, mVulD-DO (Multi-modal Joint Distillation Optimization for Vulnerability Detection), which improves the detection efficiency and accuracy of vulnerability detection.

[0005] The technical solution adopted in this invention is as follows:

[0006] A vulnerability detection method based on multimodal joint distillation optimization includes the following steps:

[0007] Step A: Multimodal feature extraction; Extract multidimensional structural dependency information from the source code and integrate function calls, execution paths, and data transfer relationships to construct a program dependency network; Based on this network, extract function names, variable names, and auxiliary representation Token_type from key code structures, and combine them with local code fragments to obtain four semantic modal feature tensors; Simultaneously, construct a heterogeneous adjacency matrix using nodes and their dependencies in the subgraph to generate graph modal feature tensors;

[0008] Step B: Multi-head feature distillation layer; The four semantic modality feature tensors generated in Step A are input into the multi-head attention mechanism to aggregate global context information and filter out key region features; Subsequently, the feedforward network performs progressive nonlinear transformations on the features at each time step to enhance the model's expressive power; The multi-scale convolutional layer extracts features from different receptive fields to further improve the ability to capture local multi-scale context patterns, while compressing the feature dimension to reduce redundancy; Finally, the four deep-distilled semantic feature tensors are concatenated in the 0th dimension, which not only preserves the independent information of each modality, but also models the global dependencies in the time dimension through BLSTM, thereby further enhancing the fusion and collaborative representation of cross-modal features and generating the final semantic auxiliary feature tensor;

[0009] Step C: Multimodal Feature Fusion and Optimization; First, a global attention layer is used to perform weighted fusion of the graph modality feature tensor and the semantic auxiliary feature tensor; through a multi-head attention mechanism, attention weights are dynamically assigned to features of different modalities to capture global dependency information across modalities, and a normalization layer ensures the stability of the fused features; next, based on the Sinkhorn distance as a regularization term, the features of the two modalities are optimized to minimize their distribution differences, further improving the alignment and complementarity of the features; the two optimized features will be re-fused in the next iteration and used for detection; finally, forward propagation and fully connected layers are used to generate class predictions for each sample, the classification loss and Sinkhorn loss together constitute the total loss function, and backpropagation is performed through joint learning to update the model parameters, thereby improving the accuracy of classification and detection.

[0010] Step A further includes:

[0011] A1: First, extract multi-dimensional structural dependency information from the source code, including function calls, execution paths, and data transfer relationships, to construct a comprehensive program dependency network; based on pre-designed vulnerability feature descriptions: arrays, pointers, operators, and API calls, perform targeted filtering on the network to identify key code structures that reflect potential vulnerability risks, and separate key subgraphs from the overall network to obtain local and focused structural information;

[0012] A2: After extracting the key subgraph, the function name, variable name and auxiliary representation Token_type are extracted from it using a tree parser. Then, combined with local code snippets, they are converted into feature tensors of multiple semantic modalities through an advanced pre-trained semantic encoder. At the same time, a heterogeneous graph structure adjacency matrix is ​​constructed based on the nodes and their dependencies in the subgraph, and graph attention network is used to generate graph modal feature tensors.

[0013] Step B further includes:

[0014] B1: First, the multi-head attention layer maps the feature tensors of the four semantic modalities to multiple subspaces, and calculates the vector representations of query, key, and value in each subspace. Attention scores are calculated using the scaled dot product attention algorithm, which measures the relevance of the query vector and the key vector in the feature space. Then, the scores are normalized using the Softmax function, which transforms them into a probability distribution form to generate attention weights. High-weight regions correspond to more important features and play a key role in aggregating contextual information when the value vectors are weighted and summed, thereby dynamically filtering important regions in the input semantic features and capturing global contextual information.

[0015] B2: The feedforward network consists of two fully connected layers; the first layer maps the input features from a low dimension to a high dimension, and then introduces non-linear characteristics through the ReLU activation function; the second layer maps the features from a high dimension back to a low dimension to ensure that the output dimension is consistent with the input; the context information obtained in step B1 is input into the feedforward network to perform independent non-linear transformations on the features at each time step;

[0016] B3: The multi-scale convolutional layer takes the time-step feature representation enhanced by the feedforward network as input and uses three convolutional kernels with different receptive fields [a×a], [b×b], and [c×c] to capture different local feature details. Each convolutional kernel slides on the input feature map to extract local features within the corresponding receptive field, thereby generating feature representations at three scales. Subsequently, the multi-scale features are weighted and summed along the channel dimension through 1×1 point convolutions to remove redundant information and compress the feature dimension, generating a more compact information representation and a single-peak feature for each modality.

[0017] B4: Finally, the modal unimodal feature tensors obtained in step B3 are concatenated along the 0th dimension. This method preserves the independence between modalities and lays the foundation for subsequent cross-modal interactions. The concatenated tensors are processed by BLSTM to capture global dependencies in the time dimension, ultimately forming a unified semantic auxiliary feature tensor.

[0018] Step C further includes:

[0019] C1: By weighting the feature matrix X of the graph modality output in step A and the feature matrix Y of the semantic auxiliary features output in step B, the complex relationships between modalities are dynamically captured, ensuring that information can flow effectively from each modality. Specifically, for each modality, its features are adjusted to the same dimension through a linear transformation. The adjusted features are then subjected to multi-head attention calculation, allowing the model to focus on important parts of the features from different modalities and weight them according to their correlation. Finally, the output is normalized through a normalization layer to obtain the feature tensor after the fusion of different modalities.

[0020] C2: Calculate the square of the Euclidean distance between the two modal feature matrices X and Y, and use it as the cost matrix C; at the same time, initialize the marginal distributions of the two modal feature matrices X and Y with a uniform distribution, and initialize the dual variable as a vector of all 1s; then, update the dual variable with the Sinkhorn-Knopp alternating optimization algorithm until it converges.

[0021] C3: After the dual variables converge, the cost matrix C is transformed into the transport plan matrix according to the dual variables, and the sinkhorn distance is calculated to the final value using the regularized Wasserstein distance formula based on the transport plan matrix.

[0022] C4: Input the tensor obtained from the fusion of different modalities in step C1 into the detector, which uses Cross-Entropy Loss as the cross-entropy loss function for binary classification tasks; at the same time, add the calculated Sinkhorn distance as a regularization term to the loss function, and the regularization coefficient is dynamically adjusted according to the loss value of the model training and the sinkhorn distance. , Indicates overall scaling. Controlling the influence of classification loss on regulation; when modality distribution differences are large. Automatically enlarges to enhance alignment; when classification error is large. Automatic reduction prioritizes improving discriminative ability; this process continuously adjusts the distribution of the two modal feature spaces through joint optimization methods to better align them and achieve better feature fusion; finally, the detection results output by the model are binary classified based on the optimized feature representation.

[0023] This invention, mVulD-DO, first collects samples from the CVEfixes and SARD datasets to generate a subgraph of the Program Dependency Graph with Calls (PDGC). Then, feature extraction is performed in two ways: firstly, function names, variable names, and auxiliary representation information (Token_type) are extracted from the PDGC subgraph, and combined with code slices, input into CodeBERT for encoding to generate four semantic feature tensors; secondly, a heterogeneous adjacency matrix is ​​constructed using the nodes and edges with different attributes of the PDGC subgraph, and input into GAT for encoding to generate a graph structure feature tensor. Next, the four semantic feature tensors are distilled using a multi-head distillation network to obtain corresponding unimodal features, and BLSTM is used to further extract long-distance dependencies in the code to obtain the final semantic auxiliary features. Simultaneously, a dynamic Sinkhorn algorithm is used to calculate the distribution distance between the graph structure feature space and the semantic auxiliary feature space to optimize the alignment between modalities, and a global attention layer is used to further fuse the optimized modal features to ensure their consistency in the feature space. Finally, the distance between the fused features and the Sinkhorn is input into the detector, and the detection result is output. This invention effectively solves the problems of insufficient code semantic expression, heterogeneity in modality fusion, and feature redundancy by jointly optimizing multimodal information of the program and using a multi-head distillation network to enhance and filter the sequence modality features, thereby improving the detection efficiency and accuracy of vulnerability detection. Attached Figure Description

[0024] Figure 1 This is a schematic diagram of the framework structure of the present invention;

[0025] Figure 2 This is a schematic diagram of the architecture of the Multi-Head Feature Distillation Layer (MFDN) of the present invention. Detailed Implementation

[0026] The implementation steps of this method will be described in detail below based on the accompanying drawings. The dataset for this experiment comes from CVEfixes and SARD, and includes synthetic programs, production programs, academic programs, and real-world vulnerability data.

[0027] Reference Figure 1 , Figure 2 A source code vulnerability detection method based on multimodal joint distillation optimization includes the following steps:

[0028] Step A: Multimodal Feature Extraction; Extract multidimensional structural dependency information from the source code and fuse function calls, execution paths, and data transfer relationships to construct a program dependency network; Based on this network, extract function names, variable names, and auxiliary representations (Token_type) from key code structures, and combine them with local code snippets to obtain four semantic modal feature tensors; Simultaneously, construct a heterogeneous adjacency matrix using nodes and their dependencies in the subgraph to generate graph modal feature tensors; Addressing the heterogeneity and complexity of multimodal features, this invention designs an innovative deep processing framework aimed at optimizing feature fusion and information mining, thereby fully leveraging the complementarity between different modalities. Step A further includes:

[0029] A1: First, extract multi-dimensional structural dependency information from the source code, including function calls, execution paths, and data transfer relationships, to construct a comprehensive program dependency network; based on pre-designed vulnerability feature descriptions: arrays, pointers, operators, and API calls, perform targeted filtering on the network to identify key code structures that reflect potential vulnerability risks, and separate key subgraphs from the overall network to obtain local and focused structural information;

[0030] A2: After extracting the key subgraph, a tree parser is used to extract function names, variable names, and auxiliary representation Token_type. Combined with local code snippets, these are converted into feature tensors of multiple semantic modalities through an advanced pre-trained semantic encoder. At the same time, a heterogeneous graph structure adjacency matrix is ​​constructed based on the nodes and their dependencies in the subgraph, and a graph attention network is used to generate graph modal feature tensors. These multimodal features provide rich basic information for subsequent deep fusion and optimization.

[0031] Step B: Multi-head feature distillation layer; The four semantic modality feature tensors generated in Step A are input into the multi-head attention mechanism to aggregate global context information and filter out key region features; Subsequently, the feedforward network performs progressive nonlinear transformations on the features at each time step to enhance the model's expressive power; The multi-scale convolutional layer extracts features from different receptive fields to further improve the ability to capture local multi-scale context patterns, while compressing the feature dimension to reduce redundancy; Finally, the four deep-distilled semantic feature tensors are concatenated in the 0th dimension, which not only preserves the independent information of each modality, but also models the global dependencies in the time dimension through BLSTM, thereby further enhancing the fusion and collaborative representation of cross-modal features and generating the final semantic auxiliary feature tensor.

[0032] Step B further includes:

[0033] B1: First, the multi-head attention layer maps the feature tensors of the four semantic modalities to multiple subspaces, and calculates the vector representations of query, key, and value in each subspace. Attention scores are calculated using the scaled dot product attention algorithm, which measures the relevance of the query vector and the key vector in the feature space. Then, the scores are normalized using the Softmax function, which transforms them into a probability distribution form to generate attention weights. High-weight regions correspond to more important features and play a key role in aggregating contextual information when the value vectors are weighted and summed, thereby dynamically filtering important regions in the input semantic features and capturing global contextual information.

[0034] B2: The feedforward network consists of two fully connected layers; the first layer maps the input features from a low dimension to a high dimension, and then introduces non-linear characteristics through the ReLU activation function; the second layer maps the features from a high dimension back to a low dimension to ensure that the output dimension is consistent with the input; the context information obtained in step B1 is input into the feedforward network to perform independent non-linear transformations on the features at each time step.

[0035] B3: The multi-scale convolutional layer takes the time-step feature representation enhanced by the feedforward network as input and uses three convolutional kernels with different receptive fields [a×a], [b×b], and [c×c] to capture different local feature details. Each convolutional kernel slides on the input feature map to extract local features within the corresponding receptive field, thereby generating feature representations at three scales. Subsequently, the multi-scale features are weighted and summed along the channel dimension through 1×1 point convolution to remove redundant information and compress the feature dimension, generating a more compact information representation and a single-peak feature for each modality.

[0036] B4: Finally, the modal unimodal feature tensors obtained in step B3 are concatenated along the 0th dimension. This method preserves the independence between modalities and lays the foundation for subsequent cross-modal interactions. The concatenated tensor is processed by BLSTM to capture the global dependencies in the time dimension. This operation not only strengthens the collaborative representation between features of different modalities, but also captures the implicit complementary information at the global level, ultimately forming a unified semantic auxiliary feature tensor.

[0037] Step C: Multimodal Feature Fusion and Optimization; First, a global attention layer is used to perform weighted fusion of the graph modality feature tensor and the semantic auxiliary feature tensor; through a multi-head attention mechanism, attention weights are dynamically assigned to features of different modalities to capture global dependency information across modalities, and a normalization layer is used to ensure the stability of the fused features; next, based on the Sinkhorn distance as a regularization term, the features of the two modalities are optimized to minimize their distribution differences, further improving the alignment and complementarity of the features; the two optimized features will be re-fused in the next iteration and used for detection; finally, forward propagation and fully connected layers are used to generate class predictions for each sample, the classification loss and Sinkhorn loss together constitute the total loss function, and backpropagation is performed through joint learning to update the model parameters, thereby improving the accuracy of classification and detection.

[0038] Step C further includes:

[0039] C1: By weighting the feature matrix X of the graph modality output in step A and the feature matrix Y of the semantic auxiliary features output in step B, the complex relationships between modalities are dynamically captured, ensuring that information can flow effectively from each modality. Specifically, for each modality, its features are adjusted to the same dimension through a linear transformation. The adjusted features are then subjected to multi-head attention calculation, allowing the model to focus on important parts of the features from different modalities and weight them according to their correlation. Finally, the output is normalized through a normalization layer to obtain the feature tensor after the fusion of different modalities.

[0040] C2: Calculate the square of the Euclidean distance between the two modal feature matrices X and Y, and use it as the cost matrix C; at the same time, initialize the marginal distributions of the two modal feature matrices X and Y with a uniform distribution, and initialize the dual variable as a vector of all 1s; then, update the dual variable with the Sinkhorn-Knopp alternating optimization algorithm until it converges.

[0041] C3: After the dual variables converge, the cost matrix C is transformed into the transport plan matrix according to the dual variables, and the sinkhorn distance is calculated to the final value using the regularized Wasserstein distance formula based on the transport plan matrix.

[0042] C4: Input the tensor obtained from the fusion of different modalities in step C1 into the detector, which uses Cross-Entropy Loss as the cross-entropy loss function for binary classification tasks; at the same time, add the calculated Sinkhorn distance as a regularization term to the loss function, and the regularization coefficient is dynamically adjusted according to the loss value of the model training and the sinkhorn distance. , Indicates overall scaling. Controlling the influence of classification loss on regulation; when modality distribution differences are large. Automatically enlarges to enhance alignment; when classification error is large. Automatic reduction prioritizes improving discriminative ability; this process continuously adjusts the distribution of the two modal feature spaces through joint optimization methods to better align them and achieve better feature fusion; finally, the detection results output by the model are binary classified based on the optimized feature representation.

[0043] Refer to Table 1: The experimental dataset is a hybrid dataset of CVEfixes and SARD. Classic deep learning-based methods VulDeePecker, SlicedLocator, SySeVR, and Devign were selected for comparative experiments with the mVulD-DO method. The dataset was divided into training, validation, and test sets in an 8:1:1 ratio to balance positive and negative samples. The table shows the comparative experimental results of the mVulD-DO method with other methods. The results show that mVulD-DO outperforms the sequence-based VulDeePecker, SySeVR, and graph-based Devign by 32.14%, 9.72%, and 24% in average ACC, respectively. It also outperforms the dual-channel sequence and graph-based SlicedLocator method by 5.07%. For recall, F1 score, and FPR, this method also outperforms the comparative methods, indicating that this method can not only more comprehensively capture real vulnerabilities in vulnerability detection (higher recall and F1 score) but also effectively reduce false positives (lower FPR), thereby improving overall detection performance and practicality.

[0044] Table 1. Experimental data comparing the detection performance of this invention with other vulnerability detection methods.

[0045]

[0046] Referring to Table 2: To demonstrate the effectiveness of function name, variable name, Token_Type, multi-head feature distillation, and Sinkhorn optimization on mVulD-DO, this invention designed the following 5 sets of ablation experiments, using Recall, Acc, F1 score, and FPR as evaluation metrics. mVulD-DO improved the F1 score by 1.3%, 1.3%, and 3.35% compared to methods without function name, variable name, and Token_Type as modalities, respectively, and by 9.11% and 1.77% compared to methods without feature distillation and Sinkhorn optimization, respectively. mVulD-DO also outperformed these ablation experiments in both ACC and FPR, indicating that this method has advantages in overall classification performance and false positive rate control. The slightly lower recall may be because feature distillation and Sinkhorn optimization, to some extent, enhanced the model's focus on high-confidence features, thus affecting the recall of some boundary samples. However, overall, mVulD-DO achieves optimal or near-optimal results on multiple metrics such as F1 score, ACC, and FPR by combining program semantic information (function name, variable name, code slice, token_type) and graph structure information (control dependency, data dependency, function call dependency) and utilizing a multi-head distillation network to enhance and filter the sequence modality features. It effectively solves the problems of insufficient code semantic expression, modality fusion heterogeneity, and feature redundancy, thereby improving the model's detection efficiency and the accuracy of vulnerability detection.

[0047] Table 2 Ablation Experiment Results of the Invention

[0048] method Recall / % FPR / % F1 / % ACC / % mVulD-DO (unfunc) 87.99 16.75 85.07 85.25 mVulD-DO (unvar) 87.60 16.43 85.07 85.27 mVulD-DO (untype) 83.78 17.06 83.02 83.30 mVulD-DO (undis) 68.49 12.19 77.26 77.27 mVulD-DO (unsinkhorn) 85.77 15.84 84.60 84.84 mVulD-DO 83.59 10.98 86.37 87.11

Claims

1. A vulnerability detection method based on multimodal joint distillation optimization, characterized in that, Includes the following steps: Step A: Multimodal feature extraction; Extract multidimensional structural dependency information from the source code, and integrate function calls, execution paths and data transfer relationships to construct a program dependency network; Based on this network, extract function names, variable names and auxiliary representation Token_type from key code structures, and then combine them with local code fragments to obtain four semantic modal feature tensors; Meanwhile, a heterogeneous adjacency matrix is ​​constructed using nodes and their dependencies in the subgraph to generate graph modal feature tensors; Step A further includes: A1: First, extract multi-dimensional structural dependency information from the source code, including function calls, execution paths, and data transfer relationships, to construct a comprehensive program dependency network; based on pre-designed vulnerability feature descriptions: arrays, pointers, operators, and API calls, perform targeted filtering on the network to identify key code structures that reflect potential vulnerability risks, and separate key subgraphs from the overall network to obtain local and focused structural information; A2: After extracting the key subgraph, the function name, variable name and auxiliary representation Token_type are extracted from it using a tree parser. Then, combined with local code snippets, they are converted into feature tensors of multiple semantic modalities through an advanced pre-trained semantic encoder. At the same time, a heterogeneous graph structure adjacency matrix is ​​constructed based on the nodes and their dependencies in the subgraph, and graph attention network is used to generate graph modal feature tensors. Step B: Multi-head feature distillation layer; The four semantic modality feature tensors generated in Step A are input into the multi-head attention mechanism to aggregate global context information and filter out key region features; Subsequently, the feedforward network performs progressive nonlinear transformations on the features at each time step to enhance the model's expressive power; The multi-scale convolutional layer extracts features from different receptive fields to further improve the ability to capture local multi-scale context patterns, while compressing the feature dimension to reduce redundancy; Finally, the four deep-distilled semantic feature tensors are concatenated in the 0th dimension, which not only preserves the independent information of each modality, but also models the global dependencies in the time dimension through BLSTM, thereby further enhancing the fusion and collaborative representation of cross-modal features and generating the final semantic auxiliary feature tensor; Step C: Multimodal Feature Fusion and Optimization; First, a global attention layer is used to perform weighted fusion of the graph modality feature tensor and the semantic auxiliary feature tensor; through a multi-head attention mechanism, attention weights are dynamically assigned to features of different modalities to capture global dependency information across modalities, and a normalization layer ensures the stability of the fused features; next, based on the Sinkhorn distance as a regularization term, the features of the two modalities are optimized to minimize their distribution differences, further improving the alignment and complementarity of the features; the two optimized features will be re-fused in the next iteration and used for detection; finally, forward propagation and fully connected layers are used to generate class predictions for each sample, the classification loss and Sinkhorn loss together constitute the total loss function, and backpropagation is performed through joint learning to update the model parameters, thereby improving the accuracy of classification and detection.

2. The vulnerability detection method based on multimodal joint distillation optimization according to claim 1, characterized in that, Step B further includes: B1: First, the multi-head attention layer maps the feature tensors of the four semantic modalities to multiple subspaces, and calculates the vector representations of query, key, and value in each subspace. Attention scores are calculated using the scaled dot product attention algorithm, which measures the relevance of the query vector and the key vector in the feature space. Then, the scores are normalized using the Softmax function, which transforms them into a probability distribution form to generate attention weights. High-weight regions correspond to more important features and play a key role in aggregating contextual information when the value vectors are weighted and summed, thereby dynamically filtering important regions in the input semantic features and capturing global contextual information. B2: The feedforward network consists of two fully connected layers; the first layer maps the input features from a low dimension to a high dimension, and then introduces non-linear characteristics through the ReLU activation function; the second layer maps the features from a high dimension back to a low dimension to ensure that the output dimension is consistent with the input; the context information obtained in step B1 is input into the feedforward network to perform independent non-linear transformations on the features at each time step; B3: The multi-scale convolutional layer takes the time-step feature representation enhanced by the feedforward network as input and uses three convolutional kernels with different receptive fields [a×a], [b×b], and [c×c] to capture different local feature details. Each convolutional kernel slides on the input feature map to extract local features within the corresponding receptive field, thereby generating feature representations at three scales. Subsequently, the multi-scale features are weighted and summed along the channel dimension through 1×1 point convolutions to remove redundant information and compress the feature dimension, generating a more compact information representation and a single-peak feature for each modality. B4: Finally, the modal unimodal feature tensors obtained in step B3 are concatenated along the 0th dimension. This method preserves the independence between modalities and lays the foundation for subsequent cross-modal interactions. The concatenated tensors are processed by BLSTM to capture global dependencies in the time dimension, ultimately forming a unified semantic auxiliary feature tensor.

3. The vulnerability detection method based on multimodal joint distillation optimization according to claim 1, characterized in that, Step C further includes: C1: By weighting the feature matrix X of the graph modality output in step A and the feature matrix Y of the semantic auxiliary features output in step B, the complex relationships between modalities are dynamically captured, ensuring that information can flow effectively from each modality. Specifically, for each modality, its features are adjusted to the same dimension through a linear transformation. The adjusted features are then subjected to multi-head attention calculation, allowing the model to focus on important parts of the features from different modalities and weight them according to their correlation. Finally, the output is normalized through a normalization layer to obtain the feature tensor after the fusion of different modalities. C2: Calculate the square of the Euclidean distance between the two modal feature matrices X and Y, and use it as the cost matrix C; at the same time, initialize the marginal distributions of the two modal feature matrices X and Y with a uniform distribution, and initialize the dual variable as a vector of all 1s; then, update the dual variable with the Sinkhorn-Knopp alternating optimization algorithm until it converges. C3: After the dual variables converge, the cost matrix C is transformed into the transport plan matrix according to the dual variables, and the sinkhorn distance is calculated to the final value using the regularized Wasserstein distance formula based on the transport plan matrix. C4: Input the tensor obtained from the fusion of different modalities in step C1 into the detector, which uses Cross-Entropy Loss as the cross-entropy loss function for binary classification tasks; at the same time, add the calculated Sinkhorn distance as a regularization term to the loss function, and the regularization coefficient is dynamically adjusted according to the loss value of the model training and the sinkhorn distance. , Indicates overall scaling. Controlling the influence of classification loss on regulation; when modality distribution differences are large. Automatically enlarges to enhance alignment; when classification error is large. Automatic reduction prioritizes improving discriminative ability; this process continuously adjusts the distribution of the two modal feature spaces through joint optimization methods to better align them and achieve better feature fusion; finally, the detection results output by the model are binary classified based on the optimized feature representation.

Images