Source code vulnerability detection method based on multi-modal graph structure and hierarchical feature fusion

Abstract

The present application belongs to the field of code vulnerability detection, and relates to a source code vulnerability detection method based on multi-modal graph structure and hierarchical feature fusion. The method supplements the programming logic reflected by the source code sequence by innovatively constructing a code syntax sequence information graph. The method constructs a multi-modal graph structure through centrality analysis, and supplements the semantic information of the code from different angles. When extracting graph features, the method uses a hierarchical feature fusion method to introduce global semantics earlier and capture multi-level node dependencies. When extracting sequence features, the method uses CodeBERT to extract deeper semantic and context-related features, and further uses a BiLST combined with attention to extract local features and key features of the code. Meanwhile, the graph structure and sequence features are extracted in parallel and bilinearly fused to complement and enhance the syntax, structure and semantic information, thereby significantly improving the detection accuracy and generalization ability for complex vulnerability patterns.

Description

Technical Field

[0001] This invention belongs to the field of code vulnerability detection and relates to a source code vulnerability detection method based on the fusion of multimodal graph structure and hierarchical features. Background Technology

[0002] As software size and complexity grow exponentially, traditional static vulnerability detection methods (such as rule matching, symbolic execution, and classic static analysis tools), relying on manually constructed features and expert-based rules, struggle to balance high false positive and high false negative rates, making them insufficient for modern software security needs. In recent years, deep learning, with its end-to-end representation learning and strong nonlinear fitting capabilities, has provided a new technical path for vulnerability detection and alleviated some of the shortcomings of traditional methods. However, existing deep learning methods still face many common bottlenecks when dealing with real-world large-scale code scenarios.

[0003] At the code representation level, existing research abstracts programs into a single homogeneous graph, which makes it difficult to simultaneously characterize multidimensional semantics, resulting in the loss of critical vulnerability context information. Graph neural networks generally adopt local neighborhood aggregation strategies, which are insufficient for modeling long-distance dependencies and global topological structures, limiting the ability to capture vulnerability propagation paths across functions and modules. The features of the sequence view and graph structure view of the source code are statically spliced ​​or simply weighted and fused, lacking an adaptive fusion mechanism that dynamically adjusts weights according to vulnerability patterns, making it difficult to adapt to the differentiated needs of different vulnerability types for heterogeneous features. Summary of the Invention

[0004] To achieve the above objectives, this invention provides a source code vulnerability detection method based on multimodal graph structure and hierarchical feature fusion. This method innovatively constructs a code word order information graph, supplementing the programming logic reflected in the source code sequence. Centrality analysis is employed to construct a multimodal graph structure, compensating for the semantic information of the code from different perspectives. During graph feature extraction, a hierarchical feature fusion method is used to introduce global semantics earlier and capture multi-level node dependencies. During sequence feature extraction, CodeBERT is used to extract deeper semantic and contextual features, and BiLST combined with attention is further employed to extract local and key features of the code. Simultaneously, graph structure and sequence features are extracted in parallel and fused bilinearly, achieving complementary enhancement of syntactic, structural, and semantic information, significantly improving the detection accuracy and generalization ability for complex vulnerability patterns.

[0005] The technical solution adopted in this invention is a source code vulnerability detection method based on the fusion of multimodal graph structure and hierarchical features, comprising the following steps: Step S1: Standardize the source code functions to be tested to obtain standardized source code; Step S2: Input the standardized source code function into the Joern tool to generate a CPG code attribute graph. Construct a CLOG graph of word order information based on the CPG graph. Combine the CLOG graph with the CPG graph to obtain the code word order attribute graph CLOPG. Step S3: Use Word2vec to embed the nodes of the CLOPG graph into vectors, and then perform centrality analysis on the CLOPG graph after node vector embedding to obtain three multimodal graph structures: CLOPG-Degree, CLOPG-Closeness, and CLOPG. Step S4: Construct a graph feature extraction network for any node in the graph. Constructing an enhanced local feature matrix and global feature matrix ; Step S5: Input the multimodal graph structure obtained in step S3 into the graph feature extraction network. After extraction, updating, and concatenation, the final graph features are obtained. ; Step S6: Input the standardized source code function into the pre-trained models CodeBERT and BiLSTM network for sequence feature extraction to obtain the final sequence feature vector. ; Step S7: The graph features obtained in step S5 and the sequence features obtained in step S6 The fusion is performed using a bilinear transformation matrix to obtain the fused comprehensive feature vector. ,in It is a learnable matrix; Step S8: Combine the fused feature vectors The input is fed into a fully connected layer, where the Softmax function calculates the probability that a sample belongs to either the "vulnerable" or "non-vulnerable" category, and finally selects the appropriate category. and The category with the larger median value is used as the prediction result to achieve accurate identification and classification of code vulnerabilities.

[0006] Furthermore, the standardization process in step S1 specifically involves replacing manually defined variable names and function names in the source code, and deleting comments and redundant blank lines from the code.

[0007] Furthermore, step S4 specifically includes: Step S4.1: For any node in the graph An enhanced local feature matrix is ​​constructed based on the distance between nodes, topological structure, and node attribute features. : ; Distance decay function: ; in, , , and For learnable parameters, For nodes and The shortest path distance; Multi-dimensional feature interaction function: ; in, , Representing nodes respectively and nodes The eigenvector of the first dimension, , and For learnable parameters, and For nodes and The Euclidean norm of the eigenvectors, and Control The weights of Gaussian similarity and cosine similarity in dimensionality; Structural similarity function: ; in, and Representing nodes respectively and The set of neighbors; Step S4.2: For any node in the graph Based on multi-angle degree differences and graph position awareness, an enhanced global feature matrix is ​​constructed. : ; Multi-angle degree relationship function: ; in, Represents a node and The degree, These are learnable parameters; Graph location-aware global relational function: ; in, and Representing nodes respectively and eigenvector centrality value, and Representing nodes respectively and betweenness centrality value, and These are learnable parameters; Step S4.3: Based on the graph diffusion entropy H(G), assign weights to obtain the fused feature matrix: ; Furthermore, step S5 specifically involves: extracting the node feature matrix for each modality. and During the update process, the neighbor information is dynamically weighted and aggregated using the fusion feature matrix Mfussion, and the node features are updated layer by layer using the following formula: ; in, Indicates the first The learnable weight matrix of the layer, Represents element-wise multiplication; After multiple rounds of updates, the three feature matrices are concatenated along the feature dimensions to obtain the final graph feature representation. .

[0008] Furthermore, step S6 specifically includes: Step S6.1: Input the standardized source code function into the pre-trained model CodeBERT to obtain... and , ={ ,.., },in , Embed dimensions for CodeBERT; Step S6.2: Embed the token into the sequence Input into the BiLSTM network, for each token BiLSTM outputs a hidden state that incorporates bidirectional context. and The final hidden representation is obtained by concatenating the two. : ; in, The hidden layer dimension of a unidirectional LSTM; For each hidden state The attention score is calculated using a single-layer feedforward network. : ; in, and These are the weight matrix and bias term of a single-layer feedforward network, respectively. For the attention dimension; Will The attention weights are obtained by performing a dot product with a learnable context vector V and then normalizing the result using the Softmax function. : ; The final token embedding sequence representation is obtained by summing all hidden states using attention weights. : ; Step S6.3: Convert the global representation attention-weighted sequence representation The features are concatenated to form a comprehensive code sequence feature vector. : ; Furthermore, step S8 specifically involves: inputting the fused integrated feature vector into a fully connected layer; and calculating the probability that a sample belongs to the "vulnerability" or "non-vulnerability" category using the Softmax function. ; in, and These are the weight matrix and bias terms in the fully connected layer; Final choice and The category with the larger median value is used as the prediction result to achieve accurate identification and classification of code vulnerabilities.

[0009] The beneficial effects of this invention are: (1) This invention constructs a unified graph representation (CLOPG) that integrates syntactic structure, control flow, data flow, and natural language characteristics of code by fusing code attribute graph (CPG) and code sequence graph (CLOG). Furthermore, by introducing degree centrality and proximity centrality analysis, a multi-level graph structure view is constructed, which effectively overcomes the limitations of traditional single graph representation in the semantic characterization of code and provides a richer and more discriminative structured information foundation for vulnerability detection tasks.

[0010] (2) The local-global feature fusion modeling method proposed in this invention captures fine-grained structural patterns through enhanced local feature matrices, captures macroscopic execution logic by combining global feature matrices based on multi-scale features, and introduces graph diffusion entropy adaptive weight allocation, which effectively solves the shortcomings of traditional graph neural networks in long-range dependency modeling and global information integration.

[0011] (3) The present invention adopts a bilinear fusion mechanism to deeply interact with graph structure features and sequence semantic features, giving full play to the respective advantages of CodeBERT in code semantic understanding and graph neural network in structural analysis, realizing complementary enhancement of local details and global context, syntactic structure and semantic information, and significantly improving the discriminative ability of representation.

[0012] (4) The entire architecture of this invention achieves end-to-end optimization from code representation to vulnerability detection. While accurately capturing code vulnerability patterns, it maintains the efficiency of analyzing large-scale code. Compared with traditional rule-based or single-modal methods, it has significantly improved in terms of detection accuracy, robustness and generalization ability. Attached Figure Description

[0013] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0014] Figure 1 This is an overall framework diagram of the method of the present invention; Figure 2 This is a diagram illustrating the source code structure as CLOPG; Figure 3 This is a schematic diagram of the conversion from a CLOPG plot to a multimodal plot; Figure 4 This is a schematic diagram of network modeling for feature extraction. Detailed Implementation

[0015] To facilitate understanding by those skilled in the art, the present invention will be further described below with reference to embodiments and accompanying drawings. The content mentioned in the embodiments is not intended to limit the present invention.

[0016] like Figure 1 As shown, this invention provides a source code vulnerability detection method based on the fusion of multimodal graph structure and hierarchical features, comprising the following steps: Step S1: Standardize the source code functions to be tested to obtain standardized source code; Specifically, standardize C / C++ source code functions, replacing manually defined variable names in the code; for example, replace int a=1 and int b=2 with int VAR1=1 and VAR2=2; replace manually defined function names in the code; for example, replace add1() and sum2() with FUN1() and FUN()2; and delete comments and extra blank lines in the code.

[0017] Step S2: Input the standardized source code function into the Joern tool to generate a CPG code attribute graph. Construct a CLOG graph of word order information based on the CPG graph. Combine the CLOG graph with the CPG graph to obtain the code word order attribute graph CLOPG. Specifically, step S2.1: Use the Joern tool to generate a code attribute graph (CPG) that integrates the abstract syntax tree (AST), control flow graph (CFG), and program dependency graph (PDG); the AST represents the syntactic structure of the code (such as expressions and statements); the CFG represents the program execution path (such as branches and loops); and the PDG represents data dependencies and control dependencies (such as how variables affect other variables). Step S2.2: The construction of CLOG is as follows Figure 2 As shown, connecting all the leaf nodes of the AST in the CPG graph yields the CLOG graph, which reflects the order in which humans read code and the logic of the code.

[0018] Step S2.3: Combine the CPG diagram and the CLOG diagram to obtain the following: Figure 2 The code word order attribute graph (CLOPG) shown.

[0019] Step S3: Use Word2vec to embed the nodes of the CLOPG graph into vectors, and then perform centrality analysis on the CLOPG graph after node vector embedding to obtain three multimodal graph structures: CLOPG-Degree, CLOPG-Closeness, and CLOPG. It is necessary to further explain the generation of the multimodal graph: In order to obtain the characteristics of nodes in different aspects, a network centrality analysis method is introduced to analyze the importance of nodes in CLOPG. This paper introduces degree centrality and proximity centrality to consider the characteristics of CLOPG from different perspectives. The definitions of the two centralities are as follows: Degree centrality: A node is the fraction of the number of nodes it is connected to. A higher degree node has more edges connected to it and is more important in the graph. The degree centrality value is normalized by dividing by the maximum possible degree in the graph (N-1), where N is the number of nodes in the graph. Represents a node The degree.

[0020] ; Proximity centrality: Indicates the distance of a node to all other nodes in a network. It is calculated as the average of the shortest path lengths from the node to all other nodes in the graph. The smaller the average shortest distance of a node, the greater its proximity centrality. Where N is the number of nodes in the graph. It is a node At The distance between them.

[0021] ; Two feature matrices with different centralities are obtained through two centrality transformations. To avoid losing the original features during the transformations, we retain the original node vector features and combine them with the features obtained from the two centrality transformations to obtain the final feature matrix. Figure 3 The three different graph feature matrices shown are CLOPG-Degree, CLOPG-Closeness, and CLOPG.

[0022] Step S4: Construct a graph feature extraction network for any node in the graph. Constructing an enhanced local feature matrix and global feature matrix ; It should be further noted that in the field of graph feature extraction, current mainstream methods mainly revolve around graph neural networks; however, these methods have a significant drawback: they overemphasize the extraction of local structural features, falling short in effectively capturing the global feature representation of a graph and failing to accurately and comprehensively present the overall structural characteristics of the graph. To address this issue, we innovatively propose a feature extraction framework, the specific architecture of which is as follows: Figure 4 As shown, this framework employs a joint modeling strategy that integrates local and global features. Unlike traditional graph neural networks that only introduce global features at the output stage, our method introduces global information from the initial stage of feature extraction. This unique design allows the model to have a global perspective from the beginning, enabling more effective modeling of the global features of the graph structure. The modeling of the graph feature extraction network includes the following steps: Step S4.1: For any node in the graph An enhanced local feature matrix is ​​constructed based on the distance between nodes, topological structure, and node attribute features. : ; Distance decay function: ; in, , , and For learnable parameters, For nodes and The shortest path distance. This function combines exponential and Gaussian decay modes, enabling more flexible capture of the impact of distance on feature propagation. The first term, exponential decay, dominates rapid decay at close range, ensuring the model prioritizes capturing core features with higher intensity within the local neighborhood. The second term, Gaussian decay, dominates gradual decay at long range, acting as a smooth "perceptual extension," allowing the model to retain weak non-local correlations over a wider area. This is achieved by introducing weight coefficients. , We can balance the contributions of the two decay mechanisms to achieve multi-scale feature extraction of graph structures from local to global.

[0023] Multi-dimensional feature interaction function: ; in, , Representing nodes respectively and nodes The eigenvector of the first dimension, , and For learnable parameters, and For nodes and The Euclidean norm of the eigenvectors, and These represent the weights for controlling the k-dimensional Gaussian similarity and the cosine similarity, respectively; this function comprehensively evaluates the nodes from two complementary perspectives: numerical difference and directional alignment. and nodes In each feature dimension Similarity on the surface, and through learnable weights and Achieve adaptive fusion.

[0024] Structural similarity function: ; in, and Representing nodes respectively and The set of neighbors; It directly measures the number of shared neighbors, reflecting the direct, local connectivity between nodes. The total neighbor size of a node is considered, and nodes with high degrees are normalized to prevent similarity bias caused by a large number of neighboring nodes. (Constant) It was introduced to ensure the numerical stability of the denominator.

[0025] Step S4.2: To overcome the bottleneck of graph neural networks in long-range dependency modeling, we construct an enhanced global feature matrix for any pair of nodes in the graph. This matrix not only encodes the macroscopic graph positional relationships between node pairs but also deeply integrates multi-angle node degree differences with distribution-aware feature quantile comparisons. Through this multi-source global information fusion, this matrix can provide a more comprehensive and structure-aware feature transfer foundation for subsequent graph representation learning than traditional local connections.

[0026] For any node in the graph Based on multi-angle degree differences and graph position awareness, an enhanced global feature matrix is ​​constructed. : ; Multi-angle degree relationship function: ; in, Represents a node and The degree, These are learnable parameters; the function aims to learn the nodes. and The degree difference is mapped to a value located at The global similarity score within the interval is calculated in two steps: First, a normalized difference index is formed by combining the relative proportion and absolute difference between degrees using a composite term; then, this difference index is converted into the final similarity score using an exponential decay function. The closer the score is to 1, the more similar the degrees of the two nodes are, and the more equivalent they are in terms of global connectivity.

[0027] Graph location-aware global relational function: ; in, and Representing nodes respectively and eigenvector centrality value, and Representing nodes respectively and betweenness centrality value, and The parameters are learnable; the two contributions are balanced. This function quantifies nodes by fusing two complementary topological role metrics. and Positional similarity within the global structure comprehensively evaluates whether pairs of nodes are both centers of influence in the global topology, thus accurately capturing the equivalence of their structural roles. The first term calculates the product of the eigenvector centralities of the two nodes. A higher product value indicates that both nodes occupy core hub positions in the graph and tend to possess similar high-level "influence." The second term is based on the absolute value of the difference in betweenness centralities between the two nodes. The smaller the difference, the larger this value, indicating that the two nodes are more similar in the graph.

[0028] Step S4.3: Based on the graph diffusion entropy H(G), assign weights to obtain the fused feature matrix: ; To dynamically balance the influence of local and global features, graph diffusion entropy is used. As a weighting metric, diffusion entropy dynamically adjusts the weights of local and global features based on the complexity of the graph; the more complex the graph, the greater the diffusion entropy, and the simpler the graph, the smaller the diffusion entropy.

[0029] Step S5: Input the multimodal graph structure obtained in step S3 into the graph feature extraction network. After extraction, updating, and concatenation, the final graph features are obtained. ; Specifically, the three types of multimodal graph structures (CLOPG-Degree, CLOPG-Closeness, and original CLOPG) generated in step S3 are first input into the graph feature extraction network in step S4 to extract the node feature matrix for each modality. , and During the update process, the fused feature matrix is ​​utilized. The neighbor information is dynamically weighted and aggregated, and the node features are updated layer by layer using the following formula: ; in Indicates the first The learnable weight matrix of the layer, This represents element-wise multiplication. After multiple rounds of updates, the three types of feature matrices are concatenated along the feature dimensions to obtain the final graph feature representation.

[0030] ; Step S6: Input the standardized source code function into the pre-trained models CodeBERT and BiLSTM network for sequence feature extraction to obtain the final sequence feature vector. ; Specifically, step S6.1: Given a standardized processing source code S={ ,.., },in Let represent the i-th code token, and l be the length of the sequence. After training the CodeBERT model, two outputs can be obtained, one of which... The output represents the average pooling result of the entire source code sequence vector; another output is the context-aware embedding for each token. ={ ,.., },in , Embed dimensions for CodeBERT. The pooled sequence vector effectively extracts global information. The output we obtain is the word vector for each code token. Therefore, we further employ a BiLSTM with an attention mechanism to perform further feature extraction on the word vectors, in order to capture local dependencies and key token information in the code sequence.

[0031] Step S6.2: We embed the token into the sequence The input is fed into a BiLSTM network. BiLSTM captures the historical and future context information of each token in the sequence through forward and backward LSTM units, respectively. For each token... BiLSTM outputs a hidden state that incorporates bidirectional context. and The final hidden representation is obtained by concatenating the two. ,in Let be the hidden layer dimension of the unidirectional LSTM. To highlight the more important tokens in the sequence, we introduce an attention mechanism on the output of the BiLSTM.

[0032] For each hidden state The attention score is calculated using a single-layer feedforward network. : ; in, and These are the weight matrix and bias term of a single-layer feedforward network, respectively. For attention dimension; Will The attention weights are obtained by performing a dot product with a learnable context vector V and then normalizing them using the Softmax function. : ; The final token embedding sequence representation is obtained by summing all hidden states using attention weights. : ; Step S6.3: Convert the global representation attention-weighted sequence representation The features are concatenated to form a comprehensive code sequence feature vector. : .

[0033] The vector It incorporates both the global semantic information extracted by CodeBERT and the local key features focused by BiLSTM and attention mechanisms, thus providing a more comprehensive representation of the sequence characteristics of the source code.

[0034] Step S7: The graph features obtained in step S5 and the sequence features obtained in step S6 The fusion is performed using a bilinear transformation matrix to obtain the fused comprehensive feature vector. ,in It is a learnable matrix; Step S8: Combine the fused feature vectors The input is fed into a fully connected layer, where the Softmax function calculates the probability that a sample belongs to either the "vulnerable" or "non-vulnerable" category. ; in, and These are the weight matrix and bias terms in the fully connected layer; Final choice and The category with the larger median value is used as the prediction result to achieve accurate identification and classification of code vulnerabilities.

[0035] The following examples provide further details.

[0036] Example 1: This embodiment provides a source code vulnerability detection method based on the fusion of multimodal graph structure and hierarchical features. Specifically, it includes the following: (1) Collect the C / C++ source code required for the project through open source websites, select the open source VulCNN dataset, preprocess it to obtain a dataset file containing vulnerability types and non-vulnerability types; Table 1 Dataset Information ; (2) Standardize the functions in the dataset, and then use the Joern tool to generate a CPG graph. Based on the CPG graph, further construct a heterogeneous graph CLOPG; input the nodes in the graph into the Word2vec model to generate the initial feature vectors of each node. (3) Analyze the CLOPG graph using degree centrality and proximity centrality to obtain different graph feature matrices CLOPG-Degree and CLOPG-Closeness. Then combine them with the original CLOPG to construct a multimodal graph structure; (4) Input the multimodal graph structure into the graph feature extraction network proposed in this method for feature learning to obtain code graph features; (5) The standardized source code is directly input into the pre-trained model CodeBERT to obtain the context-aware vector representation, and then the important node information in the code is further captured by dual BiLSTM to finally obtain the sequence feature representation of the code; (6) The extracted graph features and sequence features are fused using a bilinear transformation matrix. The fused feature vector is then input into the classification layer, and the vulnerability detection results of the source code are output. (7) Divide the dataset into training set, validation set and test set in a ratio of 70%:20%:10%. Then use the training set to train the graph feature extraction model and the sequence feature extraction model. (8) Treat each function in the test set as the source code to be detected, and use the trained model to predict whether these functions contain vulnerabilities. Evaluate the method of this embodiment and existing vulnerability detection methods on the same dataset, and use two performance metrics (Accuracy and F1-score) from the vulnerability detection research field to evaluate the quality of the model. Accuracy refers to "the number of correctly predicted samples ÷ the total number of samples"; F1-score takes into account both precision and recall, achieving a balance between the two.

[0037] Table 2 shows the comparison results between the method in Example 1 and the VulCNN method. ; Experiments show that the source code vulnerability detection method proposed in this embodiment, based on the fusion of multimodal graph structure and hierarchical features, can perform more reliable vulnerability detection compared to other baseline methods. This embodiment's method can effectively capture syntactic and semantic information from source code, outperforming all baseline models. Specifically, compared to VulCNN, this embodiment's method improves accuracy by 4.7% and F1 score by 4.6% on the VulCNN dataset.

[0038] The above embodiments are preferred implementations of the present invention. In addition, the present invention can be implemented in other ways. Any obvious substitutions without departing from the concept of the present technical solution are within the protection scope of the present invention.

[0039] To facilitate understanding by those skilled in the art of the improvements of this invention over the prior art, some of the accompanying drawings and descriptions have been simplified, and for clarity, some other elements have been omitted from this application. Those skilled in the art should realize that these omitted elements may also constitute the content of this invention.

Claims

1. A source code vulnerability detection method based on multimodal graph structure and hierarchical feature fusion, characterized in that, Includes the following steps: Step S1: Standardize the source code functions to be tested to obtain standardized source code; Step S2: Input the standardized source code function into the Joern tool to generate a CPG code attribute graph. Construct a CLOG graph of word order information based on the CPG graph. Combine the CLOG graph with the CPG graph to obtain the code word order attribute graph CLOPG. Step S3: Use Word2vec to embed the nodes of the CLOPG graph into vectors, and then perform centrality analysis on the CLOPG graph after node vector embedding to obtain three multimodal graph structures: CLOPG-Degree, CLOPG-Closeness, and CLOPG. Step S4: Construct a graph feature extraction network for any node in the graph. Constructing an enhanced local feature matrix and global feature matrix ; Step S5: Input the multimodal graph structure obtained in step S3 into the graph feature extraction network. After extraction, updating, and concatenation, the final graph features are obtained. ; Step S6: Input the standardized source code function into the pre-trained models CodeBERT and BiLSTM network for sequence feature extraction to obtain the final sequence feature vector. ; Step S7: The graph features obtained in step S5 and the sequence features obtained in step S6 The fusion is performed using a bilinear transformation matrix to obtain the fused comprehensive feature vector. ,in It is a learnable matrix; Step S8: Combine the fused feature vectors The input is fed into a fully connected layer, where the Softmax function calculates the probability that a sample belongs to either the "vulnerability" or "non-vulnerability" category, and finally selects the appropriate category. and The category with the larger median value is used as the prediction result to achieve accurate identification and classification of code vulnerabilities.

2. The source code vulnerability detection method based on multimodal graph structure and hierarchical feature fusion as described in claim 1, characterized in that, The standardization process in step S1 specifically involves replacing manually defined variable names and function names in the source code, and deleting comments and redundant blank lines from the code.

3. The source code vulnerability detection method based on multimodal graph structure and hierarchical feature fusion as described in claim 2, characterized in that, Step S4 specifically involves: Step S4.1: For any node in the graph An enhanced local feature matrix is ​​constructed based on the distance between nodes, topological structure, and node attribute features. : ； Distance decay function: ； in, , , and For learnable parameters, For nodes and The shortest path distance; Multi-dimensional feature interaction function: ； in, , Representing nodes respectively and nodes The eigenvector of the first dimension, , and For learnable parameters, and For nodes and The Euclidean norm of the eigenvectors, and Control The weights of Gaussian similarity and cosine similarity in dimensionality; Structural similarity function: ； in, and Representing nodes respectively and The set of neighbors; Step S4.2: For any node in the graph Based on multi-angle degree differences and graph position awareness, an enhanced global feature matrix is ​​constructed. : ； Multi-angle degree relationship function: ； in, Represents a node and The degree, These are learnable parameters; Graph location-aware global relational function: ； in, and Representing nodes respectively and eigenvector centrality value, and Representing nodes respectively and betweenness centrality value, and These are learnable parameters; Step S4.3: Based on the graph diffusion entropy H(G), assign weights to obtain the fused feature matrix: 。 4. The source code vulnerability detection method based on multimodal graph structure and hierarchical feature fusion as described in claim 3, characterized in that, Step S5 specifically involves: extracting the node feature matrix for each modality. and During the update process, the neighbor information is dynamically weighted and aggregated using the fusion feature matrix Mfussion, and the node features are updated layer by layer using the following formula: ； in, Indicates the first The learnable weight matrix of the layer, Represents element-wise multiplication; After multiple rounds of updates, the three feature matrices are concatenated along the feature dimensions to obtain the final graph feature representation. .

5. The source code vulnerability detection method based on multimodal graph structure and hierarchical feature fusion as described in claim 4, characterized in that, Step S6 specifically involves: Step S6.1: Input the standardized source code function into the pre-trained model CodeBERT to obtain... and , ={ ,.., },in , Embed dimensions for CodeBERT; Step S6.2: Embed the token into the sequence Input into the BiLSTM network, for each token BiLSTM outputs a hidden state that incorporates bidirectional context. and The final hidden representation is obtained by concatenating the two. : ； in, The hidden layer dimension of a unidirectional LSTM; For each hidden state The attention score is calculated using a single-layer feedforward network. : ； in, and These are the weight matrix and bias term of a single-layer feedforward network, respectively. For attention dimension; Will The attention weights are obtained by performing a dot product with a learnable context vector V and then normalizing them using the Softmax function. : ； The final token embedding sequence representation is obtained by summing all hidden states using attention weights. : ； Step S6.3: Convert the global representation attention-weighted sequence representation The features are concatenated to form a comprehensive code sequence feature vector. : 。 6. The source code vulnerability detection method based on multimodal graph structure and hierarchical feature fusion as described in claim 5, characterized in that, Step S8 specifically involves: inputting the fused integrated feature vector into a fully connected layer; and calculating the probability that a sample belongs to either the "vulnerability" or "non-vulnerability" category using the Softmax function. ； in, and These are the weight matrix and bias terms in the fully connected layer; Final choice and The category with the larger median value is used as the prediction result to achieve accurate identification and classification of code vulnerabilities.

Images