Vulnerability detection method based on multi-view hypergraph network learning
By employing a multi-view hypergraph network learning method, a graph structure is constructed from the perspectives of class dependency, control flow, and data flow. This addresses the shortcomings of existing vulnerability detection methods in terms of accuracy and generalization ability in complex software systems, achieving efficient vulnerability detection and adaptive improvement.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- HUBEI UNIV
- Filing Date
- 2026-01-22
- Publication Date
- 2026-05-08
AI Technical Summary
Existing vulnerability detection methods suffer from low detection accuracy and weak generalization ability in complex software systems. They also have limitations in single-view feature representation, insufficient high-order correlation modeling capabilities, and low efficiency in multi-view feature fusion.
A multi-view hypergraph network learning method is adopted to construct the graph structure from three perspectives: class dependency, control flow, and data flow. The node2vec algorithm is used for embedding learning, a hypergraph is constructed, and feature extraction and adaptive weighted fusion are performed through a hypergraph neural network to achieve high-order association modeling and dynamic feature fusion.
It improves the accuracy and generalization ability of vulnerability detection, can comprehensively capture multi-dimensional correlation information of code, reduce the false negative rate, and adapt to software systems of different types and sizes.
Smart Images
Figure CN121997336A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of vulnerability detection and code analysis technology, and in particular to a vulnerability detection method based on multi-view hypergraph network learning. Background Technology
[0002] As the functional complexity and code size of software systems grow exponentially, the risk of security incidents such as system malfunctions, data breaches, and service interruptions caused by vulnerabilities hidden in the code has increased significantly. This not only seriously damages the reliability, stability, and user experience of software products, but also brings direct economic losses and potential security risks to enterprises and end-users. Therefore, vulnerability detection technology, as a core means of identifying high-risk code modules early in the software development lifecycle and proactively mitigating security risks, has become a crucial link in ensuring software security.
[0003] However, existing vulnerability detection methods still have technical defects that need to be addressed in practical engineering applications, making it difficult for their detection accuracy and generalization ability to meet the security protection needs of complex software systems. Specifically, these defects are manifested in the following three aspects: the inherent limitations of single-view feature representation, the technical gaps in high-order correlation modeling capabilities, and the inefficiency and lack of adaptability of multi-view feature fusion strategies. Summary of the Invention
[0004] The purpose of this invention is to provide a vulnerability detection method based on multi-view hypergraph network learning, which solves the problems of low vulnerability detection accuracy and weak generalization ability in existing technologies.
[0005] To achieve the above objectives, this invention provides a vulnerability detection method based on multi-view hypergraph network learning, comprising the following steps: S1: Parse the bytecode file of the target software and construct the dependency graph, control flow graph, and data flow graph between classes from the perspectives of class dependency, control flow, and data flow, respectively. Use the node2vec algorithm to perform embedding learning on the nodes of the dependency graph, control flow graph, and data flow graph, respectively, and generate a 128-dimensional network embedding as the initial feature. S2, for each view, construct a hypergraph based on node embedding and optional adjacency information using the k-nearest neighbor algorithm, forming a hyperedge with each node as the center, whose members are determined by similarity ranking and capacity constraints; S3, on three views, the initial 128-dimensional features are concatenated with the 3-dimensional node attribute features, and the nodes are extracted using the same hypergraph neural network architecture. The high-dimensional features obtained from the three hypergraphs are adaptively weighted and fused through a gating network, and the fused output is probabilistically calibrated and evaluated. S4, after passing through S1-S3, yields highly aggregated code association information under multiple views, serving as guidance information for vulnerability detection.
[0006] Preferably, S1 includes the following steps: S11 uses the relevant .jar files downloaded from the official website as targets and uses open-source static analysis tools to extract three view relationships at the class level. S12, for each view, a graph embedding method of random walk + skip-gram is used to generate 128-dimensional vector representations of all nodes. The training input for the embedding is the view's... .edgelist, output as node→R 128 The vector table.
[0007] Preferably, S11 includes the following steps: S111 uses the open-source tool jdeps to directly extract class dependencies from the obtained .jar file, thus obtaining the edge data of the class dependency graph; S112, decompress the .jar file, and then use the open-source tool WALA to extract the control flow and data flow to obtain the edge data of the control flow graph and data flow graph; S113, perform naming adaptation and cleaning on the edge data obtained in steps S111 and S112, and perform consistency processing on different views; S114, based on the cleaned edge data, the three-dimensional attributes of the node are statistically analyzed: number of incoming edges deg_in, number of outgoing edges deg_out, and total degree deg.
[0008] Preferably, the construction of the hypergraph in S2 includes the following steps: S21: Read the node sequence and vector from the embedded .csv file obtained from S12, perform L2 normalization, and use it for dot product calculation of cosine similarity; S22, for each central node, traverse in descending order of similarity, skip self-loops and those below the threshold, and collect the top k nearest neighbors; S23: Using one-hop nearest neighbors as seeds, select their neighbors in descending order of similarity, exclude self-loops and centers, filter by a threshold, and add them to the candidate set. The upper limit constraint on the size of the set is cap. 2; S24, score candidate members based on their similarity to the center node: if a member is connected to the center node in the adjacency set, multiply the score by edge_type_weight to increase the weight; S25. To prevent instability caused by identical scores, candidates with identical scores are first randomly shuffled, and then sorted in descending order of scores. S26, truncate and select the first cap members that meet the threshold. If the number of selected members is not less than 3, generate a super edge for the center node; otherwise, skip it. S27. Following the methods in S21-S26, perform a gridded search on the parameters k, h, and cap used in constructing the hypergraph to find the most suitable parameter values.
[0009] Preferably, the search range for parameters k, h, and cap is: k={5,10,15,20}, h={1,2}, cap={12,20,30}.
[0010] Preferably, S3 includes the following steps: S31, Single-view feature extraction; S32, Gated Fusion and Probabilistic Calibration and Evaluation.
[0011] Preferably, S31 includes the following steps: S311: The 3D attribute features generated in S11 are concatenated column-wise with the initial features generated in S12 to form a 131-dimensional initial feature vector. The 131-dimensional initial feature vector and the hypergraph adjacency obtained in S2 are used as the input to the hypergraph neural network. Among them, the initial feature vector is 131-dimensional for each node, and a matrix X and a neighbor feature list H are constructed according to the set of effective nodes in the view; the hypergraph adjacency is the set of hyperedge members from S2, which provides an aggregated list of neighbor features for each central node. S312, Build the model architecture to process the input data: Input projection: The features of the center node and the list of neighbor features in the hypergraph are processed by Linear+ReLU to map the 131-dimensional features to the hidden layer, resulting in the center hidden layer vector h and the set of neighbor hidden layer vectors {n}. i}, transforming 131 dimensions into a 64-dimensional representation; Multi-head attention aggregation: Using the query linear mapping of the center vector and the key linear mapping of the neighbor vectors, attention weights are calculated and summed in a weighted manner. The calculation formula is as follows: ; ; In the formula, The central hidden layer vector; Given the index of a neighboring node, iterate through all the neighbors of the central node; For the first Hidden feature vectors of neighboring nodes; This is the result of applying a query linear mapping to the central hidden layer vector; This is the result of applying a key linear mapping to the neighbor hidden layer vectors; The normalized exponential function normalizes the original association scores so that the sum of the weights is 1. These are the attention weights, representing the central hidden layer vector. With the Hidden vectors of neighboring nodes The degree of importance of the relationship between them; The number of heads in the multi-head attention mechanism is a hyperparameter representing the number of times the attention mechanism is executed in parallel. The aggregated feature vector is a 64-dimensional feature obtained by weighted summation of neighboring nodes and multi-head averaging. The average of the multiple results is then added to the central residual, as shown in the following formula: ; In the formula, This is the hidden feature vector updated by the center node, which is the sum of the residuals between the original center feature and the neighbor aggregated feature; Classification Head and Regularization: After Dropout, the output is a Linear function that returns logits, and the hidden layer representation h is returned as a high-dimensional feature of the view. S313, the model architecture constructed by S312 for each of the three views, outputs the high-dimensional features h of each view. cdg h cfg h dfg .
[0012] Preferably, S32 includes the following steps: S321, Read the three-view test features, align them with the common nodes of the label file, and make f cdg f cfg f dfg Fusion according to the same sequence; In S322, the gated network is fused, and the 64-dimensional features of the three views extracted in S312 are concatenated column-wise to form 192 dimensions. After weight estimation: Linear + ReLU + Dropout, the three weights are output through Linear and then softmax is used to obtain w. cdg w cfg w dfg ; via fused=w cdg ·f cdg +w cfg ·f cfg +w dfg ·f dfg Weighted fusion is performed, where fused is the multi-view gated weighted fusion feature vector, that is, the final aggregated feature after adaptive weighted summation of the features of the three views CDG / CFG / DFG, and finally the fused logits and probabilities are output by Linear. S323 uses stratified sampling to divide the data into training and test sets in a 7:3 ratio, and sets a fixed random seed to iteratively train the model. S324, probabilistic calibration, uses the fusion score of the training set to train the LogisticRegression calibrator and performs posterior calibration on the fusion score of the test set.
[0013] Preferably, S4 includes the following steps: S41, obtain the .csv file marked with vulnerabilities from the official website; S42, perform three-view feature extraction and network embedding based on S1; S43, construct the hypergraph based on S2; S44 performs feature splicing, high-dimensional feature aggregation, and fusion operations based on S3; S45 uses the trained model to predict whether new instances have vulnerabilities.
[0014] Therefore, the vulnerability detection method based on multi-view hypergraph network learning described above, as used in this invention, has the following beneficial effects: 1. Overcoming the limitations of single-perspective feature representation: This invention constructs a graph structure from three key perspectives: class dependency, control flow, and data flow, comprehensively capturing multi-dimensional correlation information of the code, solving the feature bias and incompleteness caused by a single perspective, and laying the foundation for improving detection accuracy; 2. Achieve effective modeling of high-order relationships: By constructing a hypergraph using parameterized KNN rules, it is possible to accurately characterize high-order relationships such as "one-to-many" and "many-to-many" relationships between code elements, uncover the deep-seated causes of vulnerability formation, and reduce the vulnerability miss rate; 3. Dynamic Adaptive Feature Fusion: A gated network is used to achieve adaptive weighted fusion of features from multiple perspectives. The perspective weights are dynamically adjusted according to the correlation strength between features and vulnerabilities, which effectively solves the problems of feature redundancy and loss of key information, improves the generalization ability of the model, and adapts to different types and scales of software systems.
[0015] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description
[0016] Figure 1 This is a method framework diagram of an embodiment of the present invention; Figure 2 This is a flowchart illustrating the process of extracting the CDG view from bytecode according to an embodiment of the present invention. Figure 2 In the figure, Figure (a1) is a structured description of class dependencies. It is a list of original dependency rules parsed from bytecode. It records the direct associations between classes in a JSON-like key-value pair format. Figure (a2) is a visual class dependency graph generated based on the rules of Figure (a1). It uses nodes and edges to intuitively show the associations between core classes in the Ant-1.7 project. Figure 3This is a diagram illustrating the process of extracting the CFG view from bytecode according to an embodiment of the present invention. Figure 3 In the figure, Figure (b1) shows the original control flow rules parsed from the bytecode of the Main.main() method, which describes the execution jump relationship between basic blocks within the method using structured text. Figure (b2) is a visual control flow graph generated based on the rules of Figure (b1), which shows the execution path of the Main.main() method using nodes and directed edges. Figure 4 This is a flowchart illustrating the process of extracting the DFG view from bytecode according to an embodiment of the present invention. Figure 4 In the figure, Figure (c1) shows the original data flow rules parsed from the bytecode of the Main.main() method, which describes the "definition-use" relationship of variables using structured text. Figure (c2) is a visual data flow graph generated based on the rules of Figure (c1), which uses nodes and labeled edges to show the definition, passing and use relationship of variables within the method. Figure 5 This is a process diagram illustrating the application of the present invention in vulnerability detection. Detailed Implementation
[0017] To make the objectives, technical solutions, and advantages disclosed in the embodiments of the present invention clearer, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are merely illustrative of the embodiments of the present invention and are not intended to limit the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments in this application without creative effort are within the scope of protection of this application. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout.
[0018] It should be noted that the terms “comprising” and “having”, and any variations thereof, are intended to cover non-exclusive inclusion, such that a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to such processes, methods, products, or devices.
[0019] Similar labels and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.
[0020] In the description of this invention, it should be noted that the terms "upper," "lower," "inner," "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, or the orientation or positional relationship in which the product of this invention is usually placed when in use. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limiting this invention.
[0021] In the description of this invention, it should also be noted that, unless otherwise explicitly specified and limited, the terms "set," "install," and "connect" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.
[0022] Example like Figure 1 As shown, this embodiment provides a vulnerability detection method based on multi-view hypergraph network learning, including the following steps: S1: Parse the bytecode file of the target software and construct the dependency graph, control flow graph, and data flow graph between classes from the perspectives of class dependency, control flow, and data flow, respectively. Use the node2vec algorithm to perform embedding learning on the nodes of the dependency graph, control flow graph, and data flow graph, respectively, and generate a 128-dimensional network embedding as the initial feature.
[0023] S1 includes the following steps: S11 uses the relevant .jar files downloaded from the official website as targets and employs an open-source static analysis tool to extract three view relationships at the class level.
[0024] S11 includes the following steps: S111 uses the open-source tool jdeps to directly extract class dependencies (ClassDependency Graph, CDG) from the obtained .jar file, resulting in edge data of the class dependency graph (structured edge table .csv and edge list .edgelist). For example... Figure 2As shown in Figures (a1) and (a2), org.apache.tools.ant.AntClassLoader is a user / potential thrower of org.apache.tools.ant.BuildException, with a connection AntClassLoader→BuildException (throws / uses). org.apache.tools.ant.AntClassLoader depends on org.apache.tools.ant.Project, with a connection AntClassLoader→Project (uses). org.apache.tools.ant.Target internally contains org.apache.tools.ant.Task, with a connection Target→Task (contains).
[0025] S112, decompress the .jar file, and then use the open-source tool WALA to extract the control flow graph (CFG) and data flow graph (DFG), obtaining the edge data of the control flow graph and data flow graph (structured edge table .csv and edge list .edgelist). The control flow is as follows... Figure 3 As shown in Figures (b1) and (b2), the control flow of the method `org.apache.tools.ant.Main.main` flows from the entry block to the condition block, with an edge `Entry→Cond`. When the condition is true, the flow goes to `Then`, with an edge `Cond→Then(true)`; when the condition is false, the flow goes to `Else`, with an edge `Cond→Else(false)`. The two branches merge at the merging block, with edges `Then→Merge` and `Else→Merge`. The data flow is as follows: Figure 4 As shown in Figures (c1) and (c2), in org.apache.tools.ant.Main.main, the definition of parameter args is used by ProjectHelper.parse, with an edge args_def→parse_use(use args), and the definition of Project name is used by Project.executeTargets, with an edge name_def→executeTargets_use(usename).
[0026] S113, perform naming adaptation and cleaning on the edge data obtained in steps S111 and S112, and perform consistency processing on different views.
[0027] S114, based on the cleaned edge data, the three-dimensional attributes of the node are statistically analyzed: number of incoming edges deg_in, number of outgoing edges deg_out, and total degree deg.
[0028] S12, for each view, a graph embedding method of random walk + skip-gram is used to generate 128-dimensional vector representations of all nodes. The training input for the embedding is the view's... The `.edgelist` class (where each pair of class names forms an edge) outputs as `node→R`. 128 The vector table.
[0029] S2, for each view, constructs a hypergraph based on node embedding and optional adjacency information using the k-Nearest Neighbors (KNN) algorithm rules, forming a hyperedge with each node as the center, whose members are determined by similarity ranking and capacity constraints.
[0030] Constructing a hypergraph in S2 includes the following steps: S21: Read the node sequence and vector from the embedded .csv file obtained from S12, perform L2 normalization, and use it for dot product calculation of cosine similarity.
[0031] S22, for each central node, traverse in descending order of similarity, skipping self-loops and those below the threshold, and collect the top k nearest neighbors.
[0032] S23: Using one-hop nearest neighbors as seeds, select their neighbors in descending order of similarity, exclude self-loops and centers, filter by a threshold, and add them to the candidate set. The upper limit constraint on the size of the set is cap. 2.
[0033] S24, score candidate members based on their similarity to the center node: if a member is connected to the center node in the adjacency set, multiply the score by edge_type_weight to increase the weight.
[0034] S25. To prevent instability caused by identical scores, candidate members with identical scores are first randomly shuffled. The purpose is to prevent the selection order from being fixed due to identical scores, which would affect the stability of the hypergraph construction. Then, they are sorted in descending order of scores.
[0035] S26, truncate and select the first cap members that meet the threshold. If the number of selected members is not less than 3, generate a superedge (center, member list) for the center node; otherwise, skip it.
[0036] S27. Following the methods in S21-S26, perform a grid search on the parameters k, h, and cap used in constructing the hypergraph to find the most suitable parameter values. The search range for parameters k, h, and cap is: k={5,10,15,20}, h={1,2}, cap={12,20,30}. For the three views, the optimal parameter settings are: CDG: k=20, h=2, cap=12; CFG: k=20, h=2, cap=30; DFG: k=10, h=2, cap=12.
[0037] S3, in the three views, the initial 128-dimensional features are concatenated with the 3-dimensional node attribute features. High-dimensional features of the nodes are extracted using a Hypergraph Neural Networks (HGNN) architecture with the same settings in each view. The high-dimensional features obtained from the three hypergraphs are then adaptively weighted and fused through a gating network. The fused output is then probabilistically calibrated and evaluated to improve separability and stability. Separability refers to the ability to separate the feature vectors of "vulnerable" and "non-vulnerable" samples in high-dimensional space, which is crucial for ensuring the accuracy of vulnerability detection. The aforementioned fusion and calibration operations amplify the feature differences between the two types of samples, making the classification model easier to distinguish.
[0038] S3 includes the following steps: S31, Single-view feature extraction (shared HGNN).
[0039] S31 includes the following steps: S311 concatenates the 3D attribute features generated in S11 with the initial features generated in S12 column-wise to form a 131-dimensional initial feature vector. The 131-dimensional initial feature vector and the hypergraph adjacency obtained in S2 are used as inputs to the HGNN. The initial feature vector is 131-dimensional per node (128-dimensional embedding + 3-dimensional attribute features), and a matrix X and a neighbor feature list H are constructed based on the set of effective nodes in the view. The hypergraph adjacency is the set of hyperedge members from S2, which provides an aggregated list of neighbor features for each central node.
[0040] S312, Build the model architecture to process the input data: Input projection: The features of the center node and the list of neighbor features in the hypergraph are processed by Linear(in_dim→hidden) + ReLU (center / nearby) to map the 131-dimensional features to the hidden layer, resulting in the center hidden vector h and the set of neighbor hidden vectors {n}. i}, transforming 131 dimensions into a 64-dimensional representation.
[0041] Multi-head attention aggregation (heads=2): Using the query linear mapping of the center vector and the key linear mapping of the neighbor vectors, attention weights are calculated and summed in a weighted manner. The calculation formula is as follows: ; ; In the formula, The central hidden layer vector; Given the index of a neighboring node, iterate through all the neighbors of the central node; For the first Hidden feature vectors of neighboring nodes; The result of applying a query linear mapping to the central hidden layer vector (each head set of weights); The weighted summation uses the neighbor hidden features themselves as the result of applying a key linear mapping to the neighbor hidden vectors (each head set of weights). Key mapping Used only for scoring, not for weighted aggregation; The normalized exponential function normalizes the original association scores so that the sum of the weights is 1. These are the attention weights, representing the central hidden layer vector. With the Hidden vectors of neighboring nodes The degree of importance of the relationship between them; The number of heads in the multi-head attention mechanism is a hyperparameter representing the number of times the attention mechanism is executed in parallel. The aggregated feature vector is a 64-dimensional feature obtained by weighted summation of neighboring nodes and multi-head averaging. The average of the multiple results is then added to the central residual, as shown in the following formula: ; In the formula, This is the hidden feature vector updated by the center node, which is the sum of the residuals between the original center feature and the neighbor aggregated feature; Classification Head and Regularization: After Dropout, the output logits are processed by Linear(hidden→2), and the hidden layer representation h (64-dimensional) is returned as the high-dimensional feature of this view.
[0042] S313, the model architecture constructed by S312 for each of the three views, outputs the high-dimensional features h of each view. cdg h cfg h dfg .
[0043] S32, Gated Fusion and Probabilistic Calibration and Evaluation.
[0044] S32 includes the following steps: S321, Read the three-view test features, align them with the common nodes of the label file, and make f cdg f cfg f dfg Fusion according to the same sequence.
[0045] In S322, the gated network is fused, and the 64-dimensional features of the three views extracted in S312 are concatenated column-wise to form 192 dimensions. After weight estimation: Linear(192→64) + ReLU + Dropout, the three-way weights are output through Linear(64→3), and softmax is used to obtain w. cdg w cfg w dfg ; via fused=w cdg ·f cdg +w cfg ·f cfg +w dfg ·f dfg (Maintaining 64 dimensions) weighted fusion is performed, where fused is the multi-view gated weighted fusion feature vector (64 dimensions), which is the final aggregated feature after adaptive weighted summation of the three view features CDG / CFG / DFG. Finally, the fused logits and probabilities are output through Linear(64→2).
[0046] S323 uses stratified sampling to divide the data into training and test sets in a 7:3 ratio, and sets a fixed random seed to iteratively train the model.
[0047] S324, probabilistic calibration, uses the fusion score of the training set to train the LogisticRegression calibrator (liblinear) and performs posterior calibration on the fusion score of the test set.
[0048] S4, after passing through S1-S3, yields highly aggregated code association information under multiple views, serving as guidance information for vulnerability detection.
[0049] S4 includes the following steps: S41. Obtain the .csv file marked with vulnerabilities from the official website.
[0050] S42, perform three-view feature extraction and network embedding based on S1.
[0051] S43, construct the hypergraph based on S2.
[0052] S44 performs feature splicing, high-dimensional feature aggregation, and fusion operations based on S3.
[0053] S45 uses the trained model to predict whether new instances have vulnerabilities.
[0054] like Figure 5 As shown, when performing vulnerability detection within a project, the instances in the training set and test set come from the same project, namely Project A. When performing cross-version, cross-project vulnerability detection, the instances in Project A are used to train the detection model, and the model is used to detect the test instances in Project B.
[0055] Therefore, the present invention employs the above-mentioned vulnerability detection method based on multi-view hypergraph network learning, which can solve the problems of low vulnerability detection accuracy and weak generalization ability in existing technologies.
[0056] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the technical solutions of the present invention, and these modifications or equivalent substitutions cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.
Claims
1. A vulnerability detection method based on multi-view hypergraph network learning, characterized in that: Includes the following steps: S1: Parse the bytecode file of the target software and construct the dependency graph, control flow graph, and data flow graph between classes from the perspectives of class dependency, control flow, and data flow, respectively. Use the node2vec algorithm to perform embedding learning on the nodes of the dependency graph, control flow graph, and data flow graph, respectively, and generate a 128-dimensional network embedding as the initial feature. S2, for each view, construct a hypergraph based on node embedding and optional adjacency information using the k-nearest neighbor algorithm, forming a hyperedge with each node as the center, whose members are determined by similarity ranking and capacity constraints; S3, on three views, the initial 128-dimensional features are concatenated with the 3-dimensional node attribute features, and the nodes are extracted using the same hypergraph neural network architecture. The high-dimensional features obtained from the three hypergraphs are adaptively weighted and fused through a gating network, and the fused output is probabilistically calibrated and evaluated. S4, after passing through S1-S3, yields highly aggregated code association information under multiple views, serving as guidance information for vulnerability detection.
2. The vulnerability detection method based on multi-view hypergraph network learning according to claim 1, characterized in that: S1 includes the following steps: S11 uses the relevant .jar files downloaded from the official website as targets and uses open-source static analysis tools to extract three view relationships at the class level. S12, for each view, a graph embedding method of random walk + skip-gram is used to generate 128-dimensional vector representations of all nodes. The training input for the embedding is the view's... .edgelist, output as node→R 128 The vector table.
3. The vulnerability detection method based on multi-view hypergraph network learning according to claim 2, characterized in that: S11 includes the following steps: S111 uses the open-source tool jdeps to directly extract class dependencies from the obtained .jar file, thus obtaining the edge data of the class dependency graph; S112, decompress the .jar file, and then use the open-source tool WALA to extract the control flow and data flow to obtain the edge data of the control flow graph and data flow graph; S113, perform naming adaptation and cleaning on the edge data obtained in steps S111 and S112, and perform consistency processing on different views; S114, based on the cleaned edge data, the three-dimensional attributes of the node are statistically analyzed: number of incoming edges deg_in, number of outgoing edges deg_out, and total degree deg.
4. The vulnerability detection method based on multi-view hypergraph network learning according to claim 3, characterized in that: Constructing a hypergraph in S2 includes the following steps: S21: Read the node sequence and vector from the embedded .csv file obtained from S12, perform L2 normalization, and use it for dot product calculation of cosine similarity; S22, for each central node, traverse in descending order of similarity, skip self-loops and those below the threshold, and collect the top k nearest neighbors; S23: Using one-hop nearest neighbors as seeds, select their neighbors in descending order of similarity, exclude self-loops and centers, filter by a threshold, and add them to the candidate set. The upper limit constraint on the size of the set is cap. 2; S24, score candidate members based on their similarity to the center node: if a member is connected to the center node in the adjacency set, multiply the score by edge_type_weight to increase the weight; S25. To prevent instability caused by identical scores, candidates with identical scores are first randomly shuffled, and then sorted in descending order of scores. S26, truncate and select the first cap members that meet the threshold. If the number of selected members is not less than 3, generate a super edge for the center node; otherwise, skip it. S27. Following the methods in S21-S26, perform a gridded search on the parameters k, h, and cap used in constructing the hypergraph to find the most suitable parameter values.
5. The vulnerability detection method based on multi-view hypergraph network learning according to claim 4, characterized in that: The search range for parameters k, h, and cap is: k={5,10,15,20}, h={1,2}, cap={12,20,30}.
6. The vulnerability detection method based on multi-view hypergraph network learning according to claim 5, characterized in that: S3 includes the following steps: S31, Single-view feature extraction; S32, Gated Fusion and Probabilistic Calibration and Evaluation.
7. The vulnerability detection method based on multi-view hypergraph network learning according to claim 6, characterized in that: S31 includes the following steps: S311: The 3D attribute features generated in S11 are concatenated column-wise with the initial features generated in S12 to form a 131-dimensional initial feature vector. The 131-dimensional initial feature vector and the hypergraph adjacency obtained in S2 are used as the input to the hypergraph neural network. Among them, the initial feature vector is 131-dimensional for each node, and a matrix X and a neighbor feature list H are constructed according to the set of effective nodes in the view; the hypergraph adjacency is the set of hyperedge members from S2, which provides an aggregated list of neighbor features for each central node. S312, Build the model architecture to process the input data: Input projection: The features of the center node and the list of neighbor features in the hypergraph are processed by Linear+ReLU to map the 131-dimensional features to the hidden layer, resulting in the center hidden layer vector h and the set of neighbor hidden layer vectors {n}. i }, transforming 131 dimensions into a 64-dimensional representation; Multi-head attention aggregation: Using the query linear mapping of the center vector and the key linear mapping of the neighbor vectors, attention weights are calculated and summed in a weighted manner. The calculation formula is as follows: ； ； In the formula, The central hidden layer vector; Given the index of a neighboring node, iterate through all the neighbors of the central node; For the first Hidden feature vectors of neighboring nodes; This is the result of applying a query linear mapping to the central hidden layer vector; This is the result of applying a key linear mapping to the neighbor hidden layer vectors; The normalized exponential function normalizes the original association scores so that the sum of the weights is 1. These are the attention weights, representing the central hidden layer vector. With the Hidden vectors of neighboring nodes The degree of importance of the relationship between them; The number of heads in the multi-head attention mechanism is a hyperparameter representing the number of times the attention mechanism is executed in parallel. The aggregated feature vector is a 64-dimensional feature obtained by weighted summation of neighboring nodes and multi-head averaging. The average of the multiple results is then added to the central residual, as shown in the following formula: ； In the formula, This is the hidden feature vector updated by the center node, which is the sum of the residuals between the original center feature and the neighbor aggregated feature; Classification Head and Regularization: After Dropout, the output is a Linear function that returns logits, and the hidden layer representation h is returned as a high-dimensional feature of the view. S313, the model architecture constructed by S312 for each of the three views, outputs the high-dimensional features h of each view. cdg h cfg h dfg .
8. The vulnerability detection method based on multi-view hypergraph network learning according to claim 7, characterized in that: S32 includes the following steps: S321, Read the three-view test features, align them with the common nodes of the label file, and make f cdg f cfg f dfg Fusion according to the same sequence; In S322, the gated network is fused, and the 64-dimensional features of the three views extracted in S312 are concatenated column-wise to form 192 dimensions. After weight estimation: Linear + ReLU + Dropout, the three weights are output through Linear and then softmax is used to obtain w. cdg w cfg w dfg ; via fused=w cdg ·f cdg +w cfg ·f cfg +w dfg ·f dfg Weighted fusion is performed, where fused is the multi-view gated weighted fusion feature vector, that is, the final aggregated feature after adaptive weighted summation of the features of the three views CDG / CFG / DFG, and finally the fused logits and probabilities are output by Linear. S323 uses stratified sampling to divide the data into training and test sets in a 7:3 ratio, and sets a fixed random seed to iteratively train the model. S324, probabilistic calibration, uses the fusion score of the training set to train the LogisticRegression calibrator and performs posterior calibration on the fusion score of the test set.
9. The vulnerability detection method based on multi-view hypergraph network learning according to claim 8, characterized in that: S4 includes the following steps: S41, obtain the .csv file marked with vulnerabilities from the official website; S42, perform three-view feature extraction and network embedding based on S1; S43, construct the hypergraph based on S2; S44 performs feature splicing, high-dimensional feature aggregation, and fusion operations based on S3; S45 uses the trained model to predict whether new instances have vulnerabilities.