Vulnerability detection method based on local and global message hierarchical modeling and fusion

Abstract

The invention discloses a vulnerability detection method based on local and global message hierarchical modeling and fusion, and belongs to the field of network security. According to the method, source codes are converted into AST, CFG and DDG graph structures, a hierarchical feature extraction network is constructed, a piecewise function is adopted for local message modeling, a message matrix is generated based on node distances and feature differences, an exponential attenuation function is used for strengthening interaction of adjacent nodes, and Gaussian attenuation is adopted for noise suppression of far adjacent nodes; feature global sorting difference, a path attenuation factor and a degree balance factor are introduced in global message modeling, and cross-graph long-range dependence is captured; and a local / global message matrix is fused by self-adaptively allocating weights by using the graph diffusion entropy, and a feature extraction strategy is dynamically optimized. Multi-graph features are subjected to weighted fusion through a self-attention mechanism, semantic complementarity is enhanced, and finally a classification layer is input to realize vulnerability detection. According to the method, the problem of insufficient long-range dependence modeling of the traditional graph neural network is effectively solved, and the accuracy and robustness of vulnerability detection are remarkably improved.

Description

Technical Field

[0001] The present invention belongs to the field of network security and designs a vulnerability detection method based on local and global message layered modeling and fusion to improve the accuracy and robustness of source code vulnerability detection. Background Art

[0002] As software scale and complexity increase, source code vulnerability detection continues to gain importance. Code representation graphs such as AST and CFG contain relevant information about the source code. Therefore, leveraging these graph structures for effective vulnerability detection has become a current research hotspot. Graph neural networks are a common approach for detecting source code vulnerabilities using graphs. In graph neural networks, the message generation mechanism updates node representations by transmitting and aggregating node information, thereby revealing underlying relationships within the graph structure. However, existing graph neural networks typically focus on feature aggregation using information from adjacent nodes, which has limitations in capturing long-range dependencies.

[0003] Furthermore, existing methods fail to fully consider the interaction between graph topology and node feature vectors during message generation. Traditional models often focus on propagating local adjacency information while neglecting the global correlation of node features and the overall structure of the graph. This limitation makes it difficult for models to fully capture the long-range dependencies and interactions across the entire graph, hindering their performance.

[0004] Therefore, the present invention proposes a method based on hierarchical modeling and fusion of local and global messages, which is applied to the feature extraction network, combining local information transmission and global information integration. In the message generation stage, the dual consideration of graph topology and node feature vectors is introduced. Different from the traditional method of extracting global representation only in the readout stage, global semantics is introduced earlier to capture multi-level node dependencies. At the same time, unlike the attention mechanism that learns the weights of adjacent nodes, this method is based on the feature vector modeling of structure and nodes, which has stronger interpretability, thereby improving the accuracy and robustness of the model in tasks such as source code vulnerability detection. Summary of the Invention

[0005] The present invention aims to address the technical defects of existing graph neural networks in source code vulnerability detection, such as insufficient long-range dependency modeling capabilities due to over-reliance on local adjacency information, and insufficient integration of the interactive relationship between graph topology and node feature vectors. By layered modeling of the local message passing mechanism and the global message matrix generation method, combined with the graph diffusion entropy adaptive weight distribution, the ability to capture multi-level semantic relationships in the code and the vulnerability detection accuracy are improved.

[0006] In order to achieve the above-mentioned purpose, the present invention adopts the following technical means:

[0007] The present invention provides a vulnerability detection method based on local and global message layered modeling and fusion, comprising the following steps:

[0008] Step 1: Data preprocessing: The source code to be tested is converted into graph structures such as abstract syntax tree (AST), control flow graph (CFG), and data dependency graph (DDG) using static analysis tools. Features are then embedded into the nodes in the graph to generate feature vectors for each node.

[0009] Step 2: Graph feature extraction network construction:

[0010] Local message modeling: Based on the distance and feature differences between nodes, a piecewise function is used to generate a local message matrix. The message strength of neighboring nodes is calculated using an exponential decay function, while that of distant nodes is calculated using a Gaussian decay function. The degree normalization strategy is also used to normalize the node feature differences.

[0011] Global message modeling: Based on the global ranking difference of node features, the shortest path length, and the degree dynamic balance factor, a global message matrix is ​​constructed. The global ranking difference is calculated by the full-graph ranking position difference and feature value difference of each dimension feature.

[0012] Message fusion: adaptively assign weights based on graph diffusion entropy, perform weighted fusion on the local message matrix and the global message matrix, and generate a fused message matrix. The graph diffusion entropy is calculated based on the node degree distribution and is used to measure the complexity of the graph structure to adjust the weight ratio of global and local messages.

[0013] Node feature update: Aggregate neighbor node information by fusing the message matrix, and update node feature representation by combining activation functions and learnable parameters;

[0014] Step 3: Multi-image feature fusion: Pool and concatenate the extracted features of AST, CFG, and DDG, and calculate the correlation weights between features through the self-attention mechanism to achieve weighted fusion;

[0015] Step 4: Vulnerability detection: Input the fused features into the classification layer and output the vulnerability detection results of the source code.

[0016] In the above scheme, step 2 includes the following steps:

[0017] Step 2.1: Local message modeling: For any node pair (u, v) in the graph, based on the inter-node distance dist(u, v) and feature difference, a piecewise function is used to generate the local message matrix M local (u, v), specifically:

[0018]

[0019]

[0020] Where dist(u, v) is the distance between u and v, the distance between adjacent nodes is 1, θ is an adaptive parameter, λ and μ are learnable parameters, e is the base of the natural logarithm, d u represents the degree d of node u v represents the degree of node v, x u , x v Represent the feature vectors of nodes u and v respectively, Represents the specific value of the k-th dimension of the feature vector of node u and v respectively;

[0021] Step 2.2: Global message modeling: Construct the global message matrix M global (u, v), the calculation formula is:

[0022]

[0023] Global sorting interaction function Φ rank (u, v) is defined as follows:

[0024]

[0025] Where lg represents the logarithmic function with base 10, min(d u , d v ) represents the smaller value of the degree of nodes u and v, max(d u , d v ) represents the larger value of the degree of nodes u and v, R k (x u ), R k (x v ) represent the descending order of node u and node v in the full graph on the k-th dimension feature, N is the total number of nodes, d represents the dimension of the node feature vector, τ is the temperature coefficient, and is an adaptive parameter;

[0026] Step 2.3: Message fusion: adaptively assign weights based on the graph diffusion entropy H(G) to generate the fusion message matrix M fusion :

[0027]

[0028] M fusion =αM global +(1-α)M local

[0029] Where E is the edge set, deg(i) represents the degree of node i, α=H(G), M global is the global message matrix, M local is the local message matrix, log2 represents the logarithm with base 2;

[0030] Step 2.4: Node feature update: Aggregate neighbor node information by fusion message matrix. The update formula is:

[0031] H (l+1) =σ(M fussion H (l) W (l) )

[0032] Where σ is the Relu activation function, H (l+1) is the representation matrix of the node in the l+1 layer, W (l) The learnable weight parameter of the l+1 layer, M fussion The weighted fusion message matrix generated in the previous stage.

[0033] In the above scheme, step 3 includes the following steps:

[0034] Step 3.1: Multi-graph feature pooling and concatenation: Perform pooling operations on the graph feature extraction results of AST, CFG, and DDG respectively to generate feature vectors of the same dimension, and concatenate the three into matrix H2;

[0035] Step 3.2: Self-attention weight calculation: Generate query matrix Q, key matrix K and value matrix V based on matrix H2 attn , the calculation formula is:

[0036] Q=H2W Q , K=H2W K , V attn =H2W V

[0037] Where W Q 、W K 、W V They are all learnable parameter matrices. The attention weight matrix A is calculated based on the above matrices:

[0038]

[0039] where d k is the dimension of the query matrix Q, As a scaling factor, K T represents the transpose of K, and Softmax is the normalization function;

[0040] Step 3.3: Feature weighted fusion: Use the attention weights to weight the value matrix to generate the fused feature matrix H3:

[0041] H3=AV attn

[0042] Step 3.4: Final feature generation: Perform pooling operation on H3, calculate the average value of each component, and obtain the final fused feature vector h:

[0043]

[0044] Among them, h(j) is the j-th component of the final fused feature vector, and H3(i, j)H3(i, j) represents the j-th component of the self-attention value of the i-th feature vector.

[0045] The source code vulnerability detection method based on local and global message hierarchical modeling and fusion, described in the present invention, demonstrates significant advantages in vulnerability detection accuracy and robustness through an innovative message generation mechanism and adaptive fusion strategy. Specific beneficial effects are as follows:

[0046] 1. Hierarchical message modeling improves multi-level semantic capture capabilities

[0047] Through a layered design combining local and global message modeling, we effectively balance the local neighborhood characteristics of the code graph structure with the global long-range dependencies. Local message modeling employs exponential and Gaussian decay strategies based on node distance segmentation, enhancing interactions between neighboring nodes while suppressing long-range noise. Global message modeling captures long-range semantic connections across the graph through global feature ranking differences and path decay factors. These two complementary approaches address the inadequacy of global dependency modeling in traditional graph neural networks, which rely solely on adjacency information, significantly improving the ability to parse complex logical relationships in code.

[0048] 2. Dynamic normalization strategy enhances the robustness of local feature expression

[0049] A degree normalization strategy is introduced in local message modeling. For close-neighbor nodes, the reciprocal degree sum normalization is used to balance redundant information from highly connected nodes. For distant nodes, the reciprocal degree product normalization is used to effectively suppress interference from weakly connected nodes. This strategy dynamically adjusts message transmission strength based on node degrees, overcoming the feature bias caused by uneven node degree distribution in traditional methods. This makes the local feature extraction process more structurally adaptable and improves the model's robustness to complex code topologies.

[0050] 3. Global sorting interaction mechanism strengthens long-range dependency identification

[0051] The innovative global ranking interaction function in global message modeling accurately depicts the global semantic connections between nodes by integrating the positional and numerical differences in node features across the entire graph. This mechanism overcomes the limitations of traditional attention mechanisms that rely solely on feature similarity. By combining the relative distribution order of feature values ​​across the entire graph, it effectively identifies potential vulnerability patterns across functions and modules, significantly enhancing the detection of deep-seated logical vulnerabilities in code.

[0052] 4. Adaptive Fusion Driven by Graph Diffusion Entropy Improves Model Generalization

[0053] A dynamic weight allocation strategy based on graph diffusion entropy adaptively adjusts the fusion ratio of local and global messages according to the complexity of the graph structure. For complex graphs with dispersed node connections, global message weighting is increased to capture long-range dependencies; for densely connected graphs with regular structures, local message transmission is emphasized. This mechanism enables the model to dynamically optimize feature extraction strategies based on the topological characteristics of different code graphs, significantly improving the method's generalization across different programming languages ​​and code sizes.

[0054] 5. Multi-image feature self-attention fusion enhances semantic complementarity

[0055] A self-attention mechanism performs a relevance-weighted fusion of multi-graph features from AST, CFG, and DDG, fully exploiting the complementary semantic information of grammatical structure, control flow, and data dependencies. Compared to traditional concatenation or simple pooling methods, this mechanism dynamically evaluates the contribution of each graph feature to vulnerability detection, suppresses redundant feature interference, strengthens the synergy of key semantic features, and effectively improves the discriminative expression of vulnerability signatures.

[0056] 6. End-to-end feature learning optimizes detection accuracy

[0057] Through the hierarchical aggregation of local and global messages, iterative updating of node features, and deep fusion of multi-graph features, an end-to-end feature learning framework is constructed. This framework introduces global semantics during the message passing phase, avoiding the semantic loss caused by the separation of feature extraction and global representation in traditional methods. It achieves efficient mapping from raw code graphs to vulnerability determinations, comprehensively improving vulnerability detection accuracy and false positive suppression capabilities.

[0058] In summary, the present invention overcomes the technical bottlenecks of existing methods in long-range dependency modeling, complex structure adaptability, and multi-source feature fusion through hierarchical message modeling, dynamic fusion strategy, and multi-graph collaborative learning, providing an efficient and reliable solution for source code vulnerability detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 : Overall framework diagram of vulnerability detection;

[0060] Figure 2 : Local and global message layered modeling and fusion architecture diagram. DETAILED DESCRIPTION

[0061] The following is a detailed description of the embodiments of the present invention. Although the present invention will be described and illustrated in conjunction with certain specific embodiments, it should be noted that the present invention is not limited to these embodiments. On the contrary, modifications or equivalent substitutions of the present invention are intended to fall within the scope of the claims of the present invention.

[0062] In addition, in order to better illustrate the present invention, numerous specific details are given in the following detailed description. It will be understood by those skilled in the art that the present invention can also be implemented without these specific details.

[0063] This paper proposes a vulnerability detection method based on hierarchical modeling and fusion of local and global messages, applying it to the feature extraction network. A local and global message generation mechanism is introduced during the feature extraction process. The weights of global and local messages are adaptively adjusted through graph diffusion entropy to fully capture the multi-level information of the source code graph, thereby improving the accuracy and robustness of vulnerability detection. After completing feature extraction for the three types of graphs (AST, CFG, and DDG), a feature fusion method using a self-attention mechanism is used to calculate the correlation between features and achieve weighted fusion of each feature vector. The fused vector is then used for vulnerability detection.

[0064] S1: Data preprocessing

[0065] Before processing, source code is in text form and cannot be directly tested using a model. Therefore, source code preprocessing is required. First, the Joern static analysis tool is used to obtain three types of graph files: AST, CFG, and DDG for each function in the source code. The resulting graphs are then embedded using the Word2Vec model to obtain feature vectors for each node in the graph, thereby obtaining the graph structure and features required for feature extraction.

[0066] S2: Graph feature extraction network construction

[0067] Existing graph representation learning methods primarily employ graph neural networks, which learn node representations through neighbor feature aggregation. However, these methods still rely heavily on local structure and struggle to effectively model long-range dependencies and complex interactions. For example, GCN focuses on structural adjacency, neglecting the semantic connections between node features. While GAT introduces an attention mechanism to enhance the differential expression of neighbor features, it still lacks the ability to model the entire graph structure. While models such as GraphSAGE, GCN-V2, GATv2, GIN, and HyperGCN have optimized message propagation mechanisms and improved feature expression capabilities, most remain focused on local neighborhoods, struggling to meet the demands of global dependency modeling.

[0068] To this end, the present invention proposes a method based on hierarchical modeling and fusion of local and global messages, and constructs a feature extraction network based on this. The feature extraction network designs local propagation functions and global dependency modeling modules respectively, both of which are calculated based on node features and the overall topological structure of the graph, which is different from the traditional method of introducing global information only in the readout stage. This method can introduce the full graph context in the feature propagation stage, effectively enhancing the model's ability to model long-range dependencies and cross-graph interactions. Combined with code representation graphs such as AST, CFG and DDG, this method can more comprehensively capture multi-granularity semantic relationships and improve the accuracy and robustness of source code vulnerability detection. Figure 2 This is an architectural diagram of the hierarchical modeling and fusion of local and global messages in the present invention.

[0069] S201: Local Message Modeling

[0070] Regarding local message modeling, this paper proposes a local message passing mechanism that aims to more accurately capture the relationships between nodes. This mechanism implements local message modeling of nodes in a graph by introducing a message strength function that uses node distance as a parameter. This method divides the message passing process between nodes into two scenarios: close-range and distant nodes. Different message strength functions are designed for these two scenarios, adapting to the interaction characteristics between nodes at different distances.

[0071] For any pair of nodes u and v, the local message M between them local (u, v) is represented by a piecewise function as follows:

[0072]

[0073] Where dist(u, v) is the distance between u and v, the distance between adjacent nodes is 1, θ is an adaptive parameter (can be 0.5), determined according to the specific graph, and λ and μ are learnable parameters. For neighboring nodes, the message strength function is The use of exponential form reflects the strong influence between close nodes; for distant nodes, the message strength is Using a Gaussian function ensures that the influence of distant nodes is quickly weakened, thereby reducing the interference of irrelevant information. At the same time, in order to better handle the similarities and differences between node features, the local interaction function between nodes is:

[0074]

[0075] This function has a higher response when the features are close and can effectively reflect the similarity between nodes; when the features are very different, the increase in the denominator can effectively suppress the influence of outliers and normalize through the norm of the eigenvector to avoid calculation distortion caused by differences in eigenvalue amplitudes.

[0076] The local message adopts the degree normalization strategy. For close nodes, the inverse of the degree sum is used, that is, Normalization is performed. This method can moderately suppress the redundant interference caused by high-connectivity nodes while retaining the main information. For distant nodes, the inverse of the degree product is used, that is, As a normalization factor, this method significantly enhances the ability to suppress long-distance noise information, preventing weakly associated nodes from having too strong an impact on target nodes in multi-hop propagation, thereby effectively balancing the overall message transmission structure.

[0077] The proposed local message modeling method strengthens interactions between closely spaced nodes, fully exploiting key information features within the local structure. The impact of distant nodes is suppressed through a smoothing strategy, thereby highlighting the local nature of messages. This mechanism exhibits excellent adaptability and generalization capabilities, making it applicable to graph data with diverse structural types and feature distributions.

[0078] S202: Global Message Modeling

[0079] To achieve effective interaction and information integration among nodes on a global scale, this paper proposes a global message modeling method. By introducing a global message matrix that integrates the dynamic relationship between ranking differences, shortest paths, and degrees, it uniformly characterizes the node association weights within the entire graph, thereby achieving effective long-distance transmission and fusion of information in the graph.

[0080] For any two nodes u and v, the global message matrix between them is calculated as:

[0081]

[0082] Global sorting interaction function Φ rank (u, v) is defined as follows:

[0083]

[0084] This function is used to measure the difference in the full-graph ranking position of nodes u and v in each dimension, where R k (x v ) represents the descending order of the node u in the entire graph on the k-th dimension feature, and N is the total number of nodes. This function measures the difference in the values ​​of two node vectors. τ is the temperature coefficient, a learnable parameter that adjusts the sensitivity of this dimension to numerical differences. This function considers both eigenvalue differences and relative order within the entire graph, reflecting global interaction information between nodes.

[0085] In order to introduce distance perception information at the structural level, the present invention introduces the logarithmic path attenuation term lg[1+dist(u, v)], where dist(u, v) represents the shortest path length from node u to v. The smooth nature of the logarithmic function can effectively alleviate the problem of rapid information attenuation between distant nodes. In order to reduce the suppression effect of highly connected nodes on low-connected nodes, the degree dynamic balancing factor is introduced Where γ is an adaptive parameter. This degree dynamic balancing factor is used to adjust the influence between nodes with different connection levels and enhance the stability of the overall message transmission process.

[0086] This paper constructs a global message matrix by integrating global feature ranking differences, shortest path information, and node degree ratios. This matrix models the relationship between each pair of nodes in the graph by comprehensively considering feature differences and structural information across the entire graph. This ensures that information can be effectively disseminated and shared throughout the entire graph structure, demonstrating global message transmission capabilities.

[0087] S203: Fusion of local and global messages

[0088] In the feature extraction process of a graph, in order to dynamically balance the influence of local structure and global features, this paper introduces graph diffusion entropy as a weighting indicator. Graph diffusion entropy can quantify the structural complexity and uncertainty of the graph, thereby guiding the model to adaptively allocate weights between local and global information. Its calculation formula is as follows:

[0089]

[0090] Where N is the number of nodes in the graph, E is the edge set, and deg(i) is the degree of node i. represents the normalized degree distribution of node i associated with the edges in the entire graph, and its logarithmic term measures the information entropy of the degree distribution.

[0091] When the diffusion entropy of a graph is large, it indicates a complex structure, dispersed node connections, and a wide range of information dissemination. In this case, the global message generation mechanism is relied upon to capture global information and long-range dependencies. Conversely, when the diffusion entropy is small, the graph structure is regular and node connections are concentrated, and the local message generation mechanism is more reliant on focusing on local neighborhood features. Therefore, this paper uses diffusion entropy to adaptively adjust the weights of global and local messages and calculate weighted fused messages to improve the model's expressiveness in complex graph structures and long-range dependencies. The final weighted fused message is:

[0092] M fusion =αM global +(1-α)M local

[0093] The above messages are in the form of a matrix, where each element represents the message between the corresponding nodes, reflecting their local and global relationships, where α = H(G), M global is the global message matrix, M local is the local message matrix.

[0094] S204: Node feature update and message aggregation

[0095] After completing the weighted fusion message, the node updates its representation by aggregating messages from neighboring nodes, combining local and global information to improve the node representation capability. The formula is as follows:

[0096] H (l+1) =σ(M fussion H (l) W (l) )

[0097] Where σ is the Relu activation function, H (l+1) is the representation matrix of the node in the l+1 layer, W (l) The learnable weight parameter of the l+1 layer, M fussion This is the weighted fusion message matrix generated in the previous stage. Through this update process, nodes can update their representations at each layer based on local and global messages from their neighbors, effectively fusing the local and global structural information of the graph and ultimately obtaining rich node feature representations.

[0098] S3: Feature Fusion

[0099] To achieve the fusion of the three extracted features, the present invention introduces a self-attention mechanism to calculate the correlation between features and adaptively adjust the weights according to the importance of the features. First, the features extracted from the three types of graphs are pooled, the three extracted vectors are concatenated into an H2 matrix, and the query matrix (Query), key matrix (Key), and value matrix (Value) are calculated:

[0100] Q=H2W Q , K=H2W K , V attn =H2W V

[0101] Where W Q 、W K 、W V They are all learnable parameter matrices. The attention weight matrix A is calculated based on the above matrices:

[0102]

[0103] where d k is the dimension of the query matrix Q, As a scaling factor to prevent the inner product value from being too large and causing the gradient to explode. Finally, the attention weight is used to perform weighted fusion of the features:

[0104] H3=AV attn

[0105] After completing the weighted fusion, in order to obtain a vector of the same size as the output and generate the final fusion feature representation, the present invention performs a pooling operation on H3:

[0106]

[0107] Among them, h(j) is the j-th component of the final fused feature vector, and H3(i,j)H3(i,j) represents the j-th component of the self-attention value of the i-th feature vector.

[0108] S4: Model Integration

[0109] The feature extraction and feature fusion modules are connected in series to achieve effective module integration. After feature fusion is completed, the Softmax classification layer is connected in series to form a source code vulnerability detection model that contains multiple graph features. The overall architecture of the model is shown in Figure 1 .

[0110] Example 1

[0111] The invention proposes a vulnerability detection method based on local and global message hierarchical modeling and fusion, which is specifically applied to source code vulnerability detection in the two programming languages ​​​​C and C++.

[0112] S1: Data preprocessing

[0113] First, the Joern static analysis tool is used to obtain the AST, CFG, and DDG graph files of each function in the source code. The obtained graphs are then embedded using the Word2Vec model, with the embedding dimension set to 100, to obtain the feature vectors of each node in the graph.

[0114] S2: Graph feature extraction network construction

[0115] S201: Local Message Modeling

[0116] For any pair of nodes u and v, the local message M between them local (u, v) is represented by a piecewise function as follows:

[0117]

[0118] Where dist(u, v) is the distance between nodes u and v, and the distance between adjacent nodes is 1. Where T is the distance between the two nodes with the largest distance in the graph, and λ and μ are learnable parameters, both initially set to 0.5 and updated during the training process by error back propagation. For neighboring nodes, the message strength function is The use of exponential form reflects the strong influence between close nodes; for distant nodes, the message strength is Using a Gaussian function ensures that the influence of distant nodes is quickly weakened, thereby reducing the interference of irrelevant information. The local interaction function between nodes is:

[0119]

[0120] and As a normalization factor, it is used to balance the overall message passing structure.

[0121] S202: Global Message Modeling

[0122] For any two nodes u and v, the global message matrix between them is calculated as:

[0123]

[0124] Global sorting interaction function Φ rank (u, v) is defined as follows:

[0125]

[0126] where R k (x u ), R k (x v ) represent the descending order of node u and node v in the full graph on the k-th dimension feature, and N is the total number of nodes. It is used to measure the difference in the values ​​of two node vectors. τ is the temperature coefficient, which is used to adjust the sensitivity of this dimension to the numerical difference. It is a learnable parameter. d represents the dimension of the node feature vector.

[0127] The present invention uses the logarithmic path attenuation term lg[1+dist(u, v)], where dist(u, v) represents the shortest path length from node u to v, to alleviate the problem of rapid information attenuation between distant nodes, min(d u , d v ) represents the smaller value of the degree of nodes u and v, max(d u , d v ) represents the larger value of the degree of nodes u and v. In order to reduce the suppression effect of high-connected nodes on low-connected nodes, the degree normalization term is introduced Here γ is set to 1.

[0128] S203: Fusion of local and global messages

[0129] In the feature extraction process of the graph, the present invention introduces the graph diffusion entropy as a weight indicator, which serves as the weight of the model in local and global message fusion. Its calculation formula is as follows:

[0130]

[0131] Where N is the number of nodes in the graph, E is the edge set, and deg(i) is the degree of node i. The final weighted fusion message is:

[0132] M fusion =αM global +(1-α)M local

[0133] The above messages are in the form of a matrix, where each element represents the message between the corresponding nodes, reflecting their local and global relationships, where α = H(G), M global is the global message matrix, M local is the local message matrix.

[0134] S204: Node feature update and message aggregation

[0135] After completing the weighted fusion message, the node updates its representation by aggregating messages from neighboring nodes, combining local and global information, and the formula is as follows:

[0136] H (l+1) =σ(M fussion H (l) W (l) )

[0137] Where σ is the Relu activation function, H (l+1) is the representation matrix of the node in the l+1 layer, W (l) The learnable weight parameter of the l+1 layer, M fussion This is the weighted fusion message matrix generated in the previous stage. In this model, the number of nodes in the connection layer is set to 100, and two identical feature extraction layers are set.

[0138] S3: Feature Fusion

[0139] In the feature fusion part, we first perform a pooling operation on the features extracted from the three types of graphs to reduce them to the same dimension. The three extracted vectors are concatenated into an H2 matrix, and the query matrix (Query), key matrix (Key), and value matrix (Value) are calculated:

[0140] Q=H2W Q , K=H2W K , V attn =H2WV

[0141] Where W Q 、W K 、W V They are all learnable parameter matrices. The attention weight matrix A is calculated based on the above matrices:

[0142]

[0143] where d k is the dimension of the query matrix Q, Finally, the attention weights are used as scaling factors to perform weighted fusion of features:

[0144] H3=AV attn

[0145] After completing weighted fusion, perform pooling operation:

[0146]

[0147] Among them, h(j) is the j-th component of the final fused feature vector, and H3(i,j) represents the j-th component of the self-attention value of the i-th feature vector. This vector is used in the classification layer to realize vulnerability detection.

[0148] S4: Model Integration

[0149] The feature extraction and feature fusion modules are connected in series to achieve effective module integration. After feature fusion is completed, the Softmax classification layer is connected in series to form a source code vulnerability detection model that includes multiple graph features.

Claims

1. A vulnerability detection method based on local and global message layered modeling and fusion, characterized in that: The following steps are involved: Step 1: Data preprocessing: The source code to be tested is converted into graph structures of abstract syntax tree (AST), control flow graph (CFG), and data dependency graph (DDG) through static analysis tools. Features are then embedded into the nodes in the graph to generate feature vectors for each node. Step 2: Graph feature extraction network construction: Local message modeling: Based on the distance and feature differences between nodes, a piecewise function is used to generate a local message matrix. The message strength of neighboring nodes is determined by an exponential decay function, while that of distant nodes is determined by a Gaussian decay function. The degree normalization strategy is also used to normalize the node feature differences. Global message modeling: Based on the global ranking difference of node features, the shortest path length, and the degree dynamic balance factor, a global message matrix is ​​constructed. The global ranking difference is calculated by the full-graph ranking position difference and feature value difference of each dimension feature. Message fusion: adaptively assign weights based on graph diffusion entropy, perform weighted fusion on the local message matrix and the global message matrix, and generate a fused message matrix. The graph diffusion entropy is calculated based on the node degree distribution and is used to measure the complexity of the graph structure to adjust the weight ratio of global and local messages. Node feature update: Aggregate neighbor node information by fusing the message matrix, and update node feature representation by combining activation functions and learnable parameters; Step 3: Multi-image feature fusion: Pool and concatenate the extracted features of AST, CFG, and DDG, and calculate the correlation weights between features through the self-attention mechanism to achieve weighted fusion; Step 4: Vulnerability detection: Input the fused features into the classification layer and output the vulnerability detection results of the source code.

2. The method according to claim 1, characterized in that Step 2 includes the following steps: Step 2.1: Local message modeling: For any node pair (u, v) in the graph, based on the inter-node distance dist(u, v) and feature difference, a piecewise function is used to generate the local message matrix M local (u, v), specifically: Where dist(u, v) is the distance between u and v, the distance between adjacent nodes is 1, θ is an adaptive parameter, λ and μ are learnable parameters, e is the base of the natural logarithm, d u represents the degree d of node u v represents the degree of node v, x u , x v Represent the feature vectors of nodes u and v respectively, Represents the specific value of the k-th dimension of the feature vector of node u and v respectively; Step 2.2: Global message modeling: Construct the global message matrix M global (u, v), the calculation formula is: Global sorting interaction function Φ rank (u, v) is defined as follows: Where lg represents the logarithmic function with base 10, min(d u , d v ) represents the smaller value of the degree of nodes u and v, max(d u , d v ) represents the larger value of the degree of nodes u and v, R k (x u ), R k (x v ) represent the descending order of node u and node v in the full graph on the k-th dimension feature, N is the total number of nodes, d represents the dimension of the node feature vector, τ is the temperature coefficient, and is an adaptive parameter; Step 2.3: Message fusion: adaptively assign weights based on the graph diffusion entropy H(G) to generate the fusion message matrix M fusion : M fusion =αM global +(1-α)M local Where E is the edge set, deg(i) represents the degree of node i, α=H(G), M global is the global message matrix, M local is the local message matrix, log2 represents the logarithm with base 2; Step 2.4: Node feature update: Aggregate neighbor node information by fusion message matrix. The update formula is: H (l+1) =σ(M fussion H (l) W (l) ) Where σ is the Relu activation function, H (l+1) is the representation matrix of the node in the l+1 layer, W (l) The learnable weight parameter of the l+1 layer, M fussion The weighted fusion message matrix generated in the previous stage.

3. The method according to claim 1, characterized in that The step 3 comprises the following steps: Step 3.1: Multi-graph feature pooling and concatenation: Perform pooling operations on the graph feature extraction results of AST, CFG, and DDG respectively to generate feature vectors of the same dimension, and concatenate the three into matrix H2; Step 3.2: Self-attention weight calculation: Generate query matrix Q, key matrix K and value matrix V based on matrix H2 attn , the calculation formula is: Q=H2W Q ,K=H2W K ,V attn =H2W V Where W Q 、W K 、W V They are all learnable parameter matrices. The attention weight matrix A is calculated based on the above matrices: where d k is the dimension of the query matrix Q, As a scaling factor, K T represents the transpose of K, and Softmax is the normalization function; Step 3.3: Feature weighted fusion: Use the attention weights to weight the value matrix to generate the fused feature matrix H3: H3=OFF attn Step 3.4: Final feature generation: Perform pooling operation on H3, calculate the average value of each component, and obtain the final fused feature vector h: Among them, h(j) is the j-th component of the final fused feature vector, and H3(i, j)H3(i, j) represents the j-th component of the self-attention value of the i-th feature vector.

Images