Code vulnerability detection method and system fusing node position enhanced local graph neural network and global self-attention mechanism
By introducing Laplacian positional encoding and local-global hybrid graph representation learning modules, the problem of insufficient modeling of graph neural networks in complex code environments is solved, improving the accuracy and efficiency of code vulnerability detection, especially the ability to identify complex control flow and data flow paths.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Chinese People's Liberation Army Cyberspace Force Information Engineering University
- Filing Date
- 2025-12-18
- Publication Date
- 2026-05-12
AI Technical Summary
Existing source code vulnerability detection methods based on graph neural networks suffer from problems such as insufficient long-distance dependency modeling, convergent node features, high graph structure complexity, and lack of position-sensitive modeling in complex code environments, resulting in high false negative rates, weak model generalization ability, and low training efficiency.
Laplacian positional encoding is used to enhance node feature representation. A hybrid architecture combining local message passing and global self-attention mechanisms is used to capture dependencies across basic blocks and improve the model's ability to identify complex control flow and data flow paths through a local-global hybrid graph representation learning module.
It significantly improves the accuracy and recall rate of code vulnerability detection, especially for vulnerability types with long path dependencies, providing better support for automated security testing and code auditing.
Smart Images
Figure CN122019360A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of software security analysis technology, and in particular to a code vulnerability detection method and system that integrates a local graph neural network with node location enhancement and a global self-attention mechanism. Background Technology
[0002] Source code vulnerability detection, a crucial component of software security analysis, has gradually shifted from traditional static analysis and rule-matching methods to automated detection based on deep learning in recent years. Current mainstream methods primarily include Graph Neural Network (GNN) methods and methods combining graph simplification and reinforcement learning. GNN methods abstract function-level code into a unified graph representation containing structures such as AST, CFG, and PDG, and utilize message passing mechanisms to learn node features. Methods combining graph simplification and reinforcement learning introduce graph simplification strategies to reduce redundant information and improve global dependency modeling capabilities.
[0003] Although these methods have achieved good performance on multiple evaluation datasets, the following key issues still exist, which severely limit their effectiveness in complex code environments: (1) Insufficient long-distance dependency modeling: Traditional GNN methods mainly rely on the aggregation of local neighborhood information. In the process of multi-layer message passing, it is difficult to effectively capture the deep semantic dependency relationship across basic blocks or control flow paths in the code, resulting in a decrease in the ability to identify vulnerability types with complex condition branches and strong path dependencies. (2) Node feature convergence problem: As the number of GNN layers increases, node features tend to converge or even become highly similar, causing the model's ability to distinguish to decrease. This phenomenon significantly reduces the model's accuracy in identifying vulnerability patterns, especially in code with a large number of nonlinear control flow structures. (3) Graph structure complexity affects model performance: In actual projects, function-level graph structures often have a large number of nodes and edges, resulting in low model training efficiency and susceptibility to noise interference, which limits the model's ability to effectively model global information. (4) Lack of position-sensitive modeling mechanism: Existing methods generally ignore the topological position information of nodes in the graph and rely only on local adjacency relationship modeling. They fail to effectively integrate the relative position characteristics of nodes in the entire program structure, thus affecting the ability to identify the triggering path of critical vulnerabilities. Summary of the Invention
[0004] Existing source code vulnerability detection methods based on graph neural networks suffer from problems such as insufficient long-distance semantic dependency modeling, convergence of node features after message passing in graph neural networks, high graph structure complexity, and lack of topological position sensitivity modeling. These issues make it difficult for current technologies to effectively capture key vulnerability triggering conditions when handling complex control flow and data flow paths, resulting in high false negative rates, weak model generalization ability, and low training efficiency. To address these shortcomings, this invention proposes a code vulnerability detection method and system that integrates node position enhancement with a local graph neural network and a global self-attention mechanism. By introducing Laplacian Positional Encoding, the topological position information of nodes in the graph is enhanced, improving the model's ability to identify cross-basic block dependencies in the code. A hybrid architecture that combines local message passing and global self-attention mechanisms in parallel is designed to preserve local syntactic features while mining deep semantic relationships between all nodes in the graph, alleviating the problem of node feature convergence in multi-layer graph neural networks. Ultimately, this achieves efficient and accurate detection of function-level vulnerabilities in complex software systems, especially for vulnerability types with long path dependencies, significantly improving detection accuracy and recall, and providing better technical support for automated security testing and code auditing.
[0005] To achieve the above objectives, the present invention adopts the following technical solution: This invention proposes a code vulnerability detection method that integrates a local graph neural network with node location enhancement and a global self-attention mechanism, comprising: Step 1: Construct function-level code representation based on code attribute graph, and enhance node feature representation through node position awareness mechanism; Step 2: Train a code vulnerability detection model using the enhanced node feature representations; the code vulnerability detection model includes a local-global hybrid graph representation learning module; the local-global hybrid graph representation learning module includes a local message passing submodule and a global attention submodule; the local message passing submodule is used to obtain local structural information between nodes and their neighborhoods; the global attention submodule is used to obtain global semantic relationships between all nodes in the graph; Step 3: Perform vulnerability detection on the target code based on the trained code vulnerability detection model.
[0006] Further, step 1 includes: The source code is normalized, and an NTE edge is added to the code attribute graph to construct an extended code attribute graph. Then, Laplacian positional encoding is used to calculate the global position information of each node in the graph, and it is fused with the original node features to enhance the node representation capability.
[0007] Furthermore, the code vulnerability detection model also includes a multilayer perceptron and a classifier.
[0008] Furthermore, the local-global hybrid graph representation learning module also includes concatenating the outputs of the local message passing submodule and the global attention submodule in each layer, and inputting the concatenated information into the multilayer perceptron.
[0009] Furthermore, the multilayer perceptron performs a nonlinear transformation on the spliced information to generate a fused node representation, which is then input into the classifier for vulnerability classification.
[0010] Furthermore, the local message passing submodule and the global attention submodule run in parallel.
[0011] Furthermore, the local message passing submodule adopts a gated graph neural network structure, which controls the flow of information by introducing a gated loop unit, specifically executing the following steps: Message aggregation is performed first at each layer: in Indicates the first Layer to node The message aggregated from all neighboring nodes, express The set of neighboring nodes, It is a learnable weight matrix related to edge type. Represents a node In the Layer representation; Perform node update operations after message aggregation: in, Represents a node In the Layer representation, This indicates a gated loop unit.
[0012] Furthermore, the global attention submodule employs a self-attention mechanism, which establishes long-distance dependencies across nodes by calculating the semantic similarity between all nodes in the graph. Specifically, it performs the following steps: Attention weight calculation: in It is a node and Attention weights It is a node The query vector, It is a node The key vector, and It is a learnable weight matrix. and Representing nodes respectively and In the Layer representation, Let n be the feature dimension of the nodes in the layer, and n be the number of nodes. A new node representation is generated by weighting all nodes according to their attention weights and summing the results. in For value vectors, It is a learnable matrix.
[0013] Another aspect of this invention proposes a code vulnerability detection system that integrates a local graph neural network with node location enhancement and a global self-attention mechanism, comprising: The node representation enhancement unit is used to construct function-level code representations based on code attribute graphs and enhance node feature representations through a node position-aware mechanism. A model training unit is used to train a code vulnerability detection model using enhanced node feature representations. The code vulnerability detection model includes a local-global hybrid graph representation learning module. The local-global hybrid graph representation learning module includes a local message passing submodule and a global attention submodule. The local message passing submodule is used to obtain local structural information between nodes and their neighbors. The global attention submodule is used to obtain global semantic relationships between all nodes in the graph. The vulnerability detection unit is used to detect vulnerabilities in target code based on a trained code vulnerability detection model.
[0014] The present invention also proposes an electronic device, including a processor and a memory, wherein the memory stores a computer program that, when executed by the processor, implements the method described in any of the preceding claims.
[0015] Compared with the prior art, the present invention has the following advantages: 1. A node representation enhancement method based on Laplacian position encoding is proposed, which integrates the original node features and effectively enhances the model's ability to model long-distance path dependencies, solving the problem that traditional graph neural networks cannot capture semantic associations across basic blocks.
[0016] 2. A local-global hybrid graph representation learning module is designed, which combines gated graph neural networks (GGNN) for local message passing to capture syntactic structure information, and introduces a self-attention mechanism to achieve global semantic modeling. This overcomes the problem of node feature convergence caused by the multi-layer stacking of traditional GNNs, and significantly improves the model's ability to express and distinguish complex control flow and data flow paths. Attached Figure Description
[0017] Figure 1 One of the flowcharts for a code vulnerability detection method that integrates a local graph neural network with node position enhancement and a global self-attention mechanism, provided in an embodiment of the present invention; Figure 2 The second flowchart of a code vulnerability detection method that integrates a local graph neural network with node position enhancement and a global self-attention mechanism, provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the architecture of a code vulnerability detection system that integrates a local graph neural network with node location enhancement and a global self-attention mechanism, as provided in an embodiment of the present invention. Detailed Implementation
[0018] The present invention will be further explained below with reference to the accompanying drawings and specific embodiments: like Figure 1 , Figure 2 As shown, a code vulnerability detection method that integrates a local graph neural network with node location enhancement and a global self-attention mechanism includes: S101: Construct function-level code representation based on code attribute graph, and enhance node feature representation through node position awareness mechanism; S102: Train a code vulnerability detection model (Vul-FMGN) using enhanced node feature representations; the code vulnerability detection model includes a local-global hybrid graph representation learning module; the local-global hybrid graph representation learning module includes a local message passing submodule and a global attention submodule; the local message passing submodule is used to obtain local structural information between nodes and their neighborhoods; the global attention submodule is used to obtain global semantic relationships between all nodes in the graph; S103: Perform vulnerability detection on the target code based on the trained code vulnerability detection model.
[0019] Furthermore, the method specifically includes: First, a function-level code representation is constructed based on the code attribute graph, and node feature expression is enhanced through a node position-aware mechanism. Specifically, after normalizing the source code, an NTE (Next Token Edge) is added to the code attribute graph to construct an extended code attribute graph (ECPG). Subsequently, Laplacian Positional Encoding is used to calculate the global position information of each node in the graph, and this information is fused with the original node features to enhance node representation capabilities. The NTE edge is used to model the linear order relationship between adjacent tokens in the source code within the Abstract Syntax Tree (AST) structure, supplementing the shortcomings of control flow and data flow edges in traditional code attribute graphs and preserving the original syntactic order information of the code.
[0020] Secondly, to address the issue of homogenization of node features in traditional Graph Neural Networks (GNNs) during multi-layer message passing, the system designs a local-global hybrid graph representation learning module. This module performs two key operations in parallel: first, a local message passing mechanism based on Gated Graph Neural Networks (GGNNs) to capture local structural information between nodes and their neighbors; and second, global dependency modeling based on self-attention to explore deep semantic relationships between all nodes in the graph. By fusing the results of these two processes, the system can simultaneously capture local vulnerability features and global semantic dependencies in the code, significantly improving the model's discriminative power and vulnerability detection accuracy.
[0021] Finally, the system combines a multilayer perceptron (MLP) and a classifier to complete the final vulnerability detection task. By performing binary classification on the fused graph representation, the system can accurately identify functions with vulnerabilities and output the corresponding detection results.
[0022] 1. A node representation enhancement method based on Laplacian position coding This invention proposes a node feature enhancement method based on global topological information of graph structures, aiming to address the problems of traditional graph neural networks failing to adequately model the global positional information of nodes and struggling to capture long-distance semantic dependencies when modeling source code graph structures. This method introduces Laplacian Positional Encoding, integrating the topological positional information of each node in the graph into the node feature representation, thereby significantly improving the model's ability to perceive complex control flow paths and data dependency links.
[0023] In the field of Generative Neural Networks (GNNs), node positional encoding has emerged as a key technique to enhance the model's understanding of the underlying graph structure. This approach is particularly effective in capturing the positional information and functional roles of nodes in the global topology. Therefore, we employ Laplacian positional encoding to enrich node representations. Laplacian positional encoding, derived from the eigenvectors of the Laplacian matrix of a graph, provides an effective method for capturing positional information in graph structure data. The Laplacian matrix L is formally defined as: Where D is the degree matrix and A is the adjacency matrix. Assume the graph consists of n nodes, and the Laplacian matrix L is an n×n square matrix. By solving the eigenvalue problem given by the following equation, we can obtain the eigenvector v associated with the eigenvalue λ. Since the zero eigenvalue of the Laplacian matrix corresponds to a constant eigenvector, this set of solutions is usually discarded, and solutions with the same eigenvalue are chosen instead. Residual related to the smallest non-zero eigenvalue eigenvectors, denoted as Then this The feature vectors are concatenated column-wise to form a positional encoding matrix P, such that P = [ Since the dimension of each eigenvector is n, the dimension of the resulting matrix P is n× .
[0024] Next, to achieve effective fusion of node semantic information and location information, this invention proposes a fusion strategy of linear transformation and concatenation: First, a linear transformation is performed on the node feature matrix E to reduce its dimension from d to... The transformed node feature matrix is denoted as E', and the transformation is defined as: in W is a learnable linear transformation matrix.
[0025] Then, the transformed node matrix E is concatenated with the node position encoding matrix P along the feature dimension to obtain the final node representation V: Through the above feature fusion process, the input local-global graph representation of the learning module is obtained as a graph. , where V is the node representation, X is the edge feature, and A is the adjacency matrix.
[0026] The overall process of the node representation enhancement method based on Laplacian position coding is shown in Algorithm 1.1. 2. Local-Global Hybrid Graph Neural Network Architecture This invention proposes a Local-Global Hybrid Graph Representation Learning Module to address two key issues in traditional graph neural networks when modeling source code graph structures: first, the difficulty in capturing long-distance dependencies between nodes during local information aggregation; and second, the convergence of node features due to multi-layer message passing, reducing the model's ability to distinguish vulnerability-related semantic features. To address these issues, this invention designs a hybrid graph neural network architecture combining local message passing and global attention mechanisms. This architecture enables each node to not only perceive local syntactic structure information within its neighborhood but also establish deep semantic connections with all other nodes in the graph, thereby achieving comprehensive modeling of complex path dependencies in the code graph.
[0027] This module consists of two parallel sub-modules: a local message passing sub-module and a global attention sub-module. The local message passing sub-module, implemented using a Gated Graph Neural Network (GGNN), captures local structural information between nodes and their neighborhoods. The global attention sub-module employs a self-attention mechanism, calculating similarity weights among all nodes in the graph to uncover global dependencies between them. The outputs of these two modules are fused at each layer to form an enhanced node representation, which is ultimately used as input to a graph classification model for source code vulnerability detection.
[0028] 2.1 Local Message Passing Submodule The local message passing submodule adopts a gated graph neural network (GGNN) structure. By introducing gated recurrent units (GRUs) to control the flow of information, it effectively preserves the structural features of nodes in their local neighborhoods and alleviates the oversmoothing problem common in traditional graph neural networks.
[0029] Given a graph structure ,in Represents the node feature matrix, Represents edge attribute information, Using an adjacency matrix, the local message passing process occurs at each layer. The first step is message aggregation. Specifically, for each node... Aggregate its neighboring nodes Message: in It is a learnable weight matrix related to edge type. Represents a node In the Layer representation. Node update operations are performed after message aggregation. Specifically, using... Units aggregated messages Represented by the current node Merge the nodes to generate new node representations. 2.2 Global Attention Submodule The global attention submodule employs a self-attention mechanism, which establishes long-distance dependencies across nodes by calculating the semantic similarity among all nodes in the graph, thereby enhancing the model's ability to perceive global structural information in the graph. Specifically, for the node feature matrix... n is the number of nodes. Let be the feature dimension of the nodes in the layer. The global attention module updates nodes in two steps: attention weight calculation and node update. First, attention weights are calculated for any two nodes. and Calculate its attention weights in It is a node The query vector, It is a node The key vector, and It is a learnable weight matrix. and Representing nodes respectively and In the Layer representation.
[0030] After calculating the attention weights, a weighted sum is applied to all nodes based on these attention weights to generate a new node representation. For updating nodes... To put it another way: in For value vectors, It is a learnable matrix.
[0031] Through this mechanism, each node can dynamically focus on other nodes in the graph that are semantically related to it, thereby capturing global dependencies in the graph and significantly improving the model's ability to model complex control flow paths and data dependency links.
[0032] 2.3 Local and Global Information Fusion Strategy To fully leverage the complementary advantages of local and global information, this invention proposes a parallel fusion strategy: in each layer, the outputs of the local message passing submodule and the global attention submodule are concatenated and then transformed nonlinearly using a multilayer perceptron (MLP) to finally generate the fused node representation. in and These are the node representations output by the local and global modules, respectively. It continues to be updated as input for the next layer.
[0033] This fusion strategy ensures that the model retains the accuracy of local structure while enhancing its ability to perceive global semantics during the modeling process, thereby improving its ability to identify complex vulnerability patterns.
[0034] The overall execution flow is shown in Algorithm 2.1. Based on the above embodiments, such as Figure 3 As shown, this invention also proposes a code vulnerability detection system that integrates a local graph neural network with node location enhancement and a global self-attention mechanism, comprising: The node representation enhancement unit is used to construct function-level code representations based on code attribute graphs and enhance node feature representations through a node position-aware mechanism. A model training unit is used to train a code vulnerability detection model using enhanced node feature representations. The code vulnerability detection model includes a local-global hybrid graph representation learning module. The local-global hybrid graph representation learning module includes a local message passing submodule and a global attention submodule. The local message passing submodule is used to obtain local structural information between nodes and their neighbors. The global attention submodule is used to obtain global semantic relationships between all nodes in the graph. The vulnerability detection unit is used to detect vulnerabilities in target code based on a trained code vulnerability detection model.
[0035] As a concrete and feasible implementation, a code vulnerability detection method and system prototype that integrates local graph neural networks with node position enhancement and a global self-attention mechanism are developed. A node representation enhancement method based on Laplacian position encoding is implemented, fusing node position information from the graph structure into the original features to improve the model's ability to model long-distance semantic dependencies. A local-global hybrid graph neural network architecture is constructed, employing a gated graph neural network (GGNN) to capture neighborhood information in the local module, and introducing a self-attention mechanism in the global module to mine deep semantic relationships among all nodes in the graph. A parallel fusion strategy is used to enhance the graph representation learning effect. Ultimately, high-precision identification of function-level source code vulnerabilities is achieved, solving problems such as insufficient long-distance dependency modeling, convergent node features, and decreased detection accuracy caused by high graph structure complexity in traditional graph neural networks.
[0036] Based on the above embodiments, the present invention also proposes an electronic device, including a processor and a memory, wherein the memory stores a computer program, and the computer program, when executed by the processor, implements the method described in S101-S103.
[0037] In summary, this invention proposes a code vulnerability detection method and system that integrates local graph neural networks with node position enhancement and a global self-attention mechanism. Specifically, it involves a node representation enhancement method based on Laplacian position encoding. This method integrates global topological information of the graph structure to enhance node features. By constructing the Laplacian matrix of the graph and extracting the feature vectors corresponding to the first k non-zero minimum eigenvalues, it generates the node position encoding. This encoding is then linearly transformed and concatenated with the original node features to form the enhanced node representation. This method effectively solves the information loss problem in traditional graph neural networks when modeling long-distance semantic dependencies, and improves the model's ability to identify path dependencies across basic blocks.
[0038] This invention also proposes a local-global hybrid graph representation learning module, specifically designing a hybrid graph neural network architecture that combines local message passing and global attention mechanisms. The local message passing submodule uses a gated graph neural network (GGNN) to capture neighborhood grammatical information, while the global attention submodule introduces a self-attention mechanism to mine deep semantic relationships between all nodes in the graph. Both operate in parallel and work collaboratively through a fusion strategy, significantly alleviating the common problem of node feature convergence in multi-layer graph neural networks and enhancing the model's ability to model complex control flow and data flow paths.
[0039] The above description is only a preferred embodiment of the present invention. It should be noted that those skilled in the art can make several improvements and modifications without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.
Claims
1. A code vulnerability detection method that integrates a local graph neural network with node location enhancement and a global self-attention mechanism, characterized in that, include: Step 1: Construct function-level code representation based on code attribute graph, and enhance node feature representation through node position awareness mechanism; Step 2: Train a code vulnerability detection model using the enhanced node feature representations; the code vulnerability detection model includes a local-global hybrid graph representation learning module; the local-global hybrid graph representation learning module includes a local message passing submodule and a global attention submodule; the local message passing submodule is used to obtain local structural information between nodes and their neighborhoods; the global attention submodule is used to obtain global semantic relationships between all nodes in the graph; Step 3: Perform vulnerability detection on the target code based on the trained code vulnerability detection model.
2. The code vulnerability detection method according to claim 1, which integrates a local graph neural network with enhanced node location and a global self-attention mechanism, is characterized in that... Step 1 includes: The source code is normalized, and an NTE edge is added to the code attribute graph to construct an extended code attribute graph. Then, Laplacian positional encoding is used to calculate the global position information of each node in the graph, and it is fused with the original node features to enhance the node representation capability.
3. The code vulnerability detection method according to claim 1, which integrates a local graph neural network with enhanced node location and a global self-attention mechanism, is characterized in that... The code vulnerability detection model also includes a multilayer perceptron and a classifier.
4. The code vulnerability detection method according to claim 3, which integrates a local graph neural network with enhanced node location and a global self-attention mechanism, is characterized in that... The local-global hybrid graph representation learning module further includes concatenating the outputs of the local message passing submodule and the global attention submodule in each layer, and inputting the concatenated information into the multilayer perceptron.
5. The code vulnerability detection method according to claim 4, which integrates a local graph neural network with enhanced node location and a global self-attention mechanism, is characterized in that... The multilayer perceptron performs a nonlinear transformation on the spliced information to generate a fused node representation, which is then input into the classifier for vulnerability classification.
6. The code vulnerability detection method according to claim 1, which integrates a local graph neural network with enhanced node location and a global self-attention mechanism, is characterized in that... The local message passing submodule and the global attention submodule run in parallel.
7. The code vulnerability detection method according to claim 1, which integrates a local graph neural network with enhanced node location and a global self-attention mechanism, is characterized in that... The local message passing submodule adopts a gated graph neural network structure, which controls the flow of information by introducing a gated loop unit, and specifically executes the following steps: Message aggregation is performed first at each layer: in Indicates the first Layer to node The message aggregated from all neighboring nodes, express The set of neighboring nodes, It is a learnable weight matrix related to edge type. Represents a node In the Layer representation; Perform node update operations after message aggregation: in, Represents a node In the Layer representation, This indicates a gated loop unit.
8. The code vulnerability detection method according to claim 1, which integrates a local graph neural network with enhanced node location and a global self-attention mechanism, is characterized in that... The global attention submodule employs a self-attention mechanism, which establishes long-distance dependencies across nodes by calculating the semantic similarity between all nodes in the graph. Specifically, it performs the following steps: Attention weight calculation: in It is a node and Attention weights It is a node The query vector, It is a node The key vector, and It is a learnable weight matrix. and Representing nodes respectively and In the Layer representation, Let n be the feature dimension of the nodes in the layer, and n be the number of nodes. A new node representation is generated by weighting all nodes according to their attention weights and summing the results. in For value vectors, It is a learnable matrix.
9. A code vulnerability detection system that integrates a local graph neural network with node position enhancement and a global self-attention mechanism, characterized in that, include: The node representation enhancement unit is used to construct function-level code representations based on code attribute graphs and enhance node feature representations through a node position-aware mechanism. A model training unit is used to train a code vulnerability detection model using enhanced node feature representations. The code vulnerability detection model includes a local-global hybrid graph representation learning module. The local-global hybrid graph representation learning module includes a local message passing submodule and a global attention submodule. The local message passing submodule is used to obtain local structural information between nodes and their neighbors. The global attention submodule is used to obtain global semantic relationships between all nodes in the graph. The vulnerability detection unit is used to detect vulnerabilities in target code based on a trained code vulnerability detection model.
10. An electronic device comprising a processor and a memory, the memory storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the method as described in any one of claims 1 to 8.