Source code vulnerability detection and positioning method based on cross-modal collaborative attention mechanism

Abstract

The application belongs to the field of source code vulnerability detection and relates to a source code vulnerability detection and positioning method based on a cross-modal collaborative attention mechanism. First, a program dependency graph (PDG) is parsed from the source code to identify key nodes VPOI and extract code slice sequences and corresponding PDG subgraphs, and an associated sample set is constructed. Then, Bi-LSTM and GCN are used to learn the semantic features of the sequence and the structural dependency features of the subgraph, respectively. Next, the cross-modal affinity matrix is calculated through the collaborative attention mechanism to realize the interactive enhancement and fusion of the features and perform classification determination. Finally, the attention weight distribution is extracted for the vulnerability sample and is reversely mapped to realize accurate positioning. Through the deep fusion of multi-modal features, the detection accuracy is significantly improved, and a closed loop from "detection" to "positioning" is realized to provide intuitive and accurate guidance for vulnerability repair.

Description

Technical Field

[0001] This invention belongs to the field of code vulnerability detection and relates to a method for detecting and locating source code vulnerabilities based on a cross-modal collaborative attention mechanism. Background Technology

[0002] With the rapid expansion of software systems, source code vulnerability detection is crucial for ensuring network security. Traditional vulnerability detection mainly relies on static analysis tools or manual auditing. The former depends on expert-defined rules, has a high false positive rate, and is difficult to detect unknown vulnerabilities; the latter is inefficient and cannot meet the rapid iteration needs of modern software development.

[0003] In recent years, deep learning-based vulnerability detection methods have become a research hotspot, mainly including two technical approaches: sequence-based and graph-based. Sequence-based methods, such as those using LSTM and Transformer, treat code as a text sequence, excelling at capturing semantic information, but struggling to handle complex nonlinear logical structures in programs. Graph-based methods, such as those using GNN and GCN, convert code into a program dependency graph, effectively representing the topological structure of the code, but easily losing fine-grained semantic features such as variable names and operators during the graph transformation process. Despite some progress in existing technologies, the following shortcomings remain: 1. Most existing methods combining sequence and graph features only employ simple vector concatenation or weighted summation, lacking deep cross-modal interaction mechanisms. This makes it difficult to align heterogeneous features and fails to fully leverage the complementary advantages of multimodal approaches. 2. Most models are "black-box" detection methods, only able to output file-level or function-level classification results. They can only determine "whether there is a vulnerability" but cannot pinpoint the specific line number where the vulnerability is located. Developers still need to spend a lot of time manually investigating after receiving alerts, resulting in low repair efficiency. 3. When directly modeling the entire function code, a large number of redundant statements unrelated to the vulnerability dilute key features, leading to a decrease in detection accuracy.

[0004] Therefore, how to design a method that can deeply integrate code semantics and structural features, and accurately trace back from macroscopic detection to microscopic line-level localization, is a technical problem that urgently needs to be solved. Summary of the Invention

[0005] To address the aforementioned technical problems, this invention provides a source code vulnerability detection and localization method based on a cross-modal collaborative attention mechanism. By employing refined modeling guided by vulnerability interest points and deep bimodal interaction, the method improves vulnerability detection accuracy while achieving precise line-level vulnerability localization without the need for node labeling.

[0006] The technical solution of this invention is a source code vulnerability detection and localization method based on a cross-modal collaborative attention mechanism, comprising the following steps: Step S1: Obtain the source code data to be tested, and use the Joern tool to parse the source code into an abstract syntax tree and a control flow graph to generate a program dependency graph (PDG). Step S2: Identify key node VPoIs in the program dependency graph PDG according to the preset vulnerability interest point rules; Step S3: Starting with the VPoI node, obtain the set of nodes associated with the vulnerability logic. ,Will Perform ascending sorting and induction to generate code slice sequence S and local PDG subgraphs. At the same time, a physical mapping sub-table is established for the mapping index table L. ; Step S4: Process the code slice sequence S and the program dependency graph PDG subgraph. Perform consistency mapping on the middle node code to obtain the normalized code slice sequence and the node code attribute text; Step S5: Convert the normalized code slice sequence and node code attribute text into a token sequence and a token subsequence, and append the attribution relationship subtable to the mapping index table L. The trained Word2vec model is used to map each token to a dimension of . The feature vectors are used to form the sequence embedding matrix and the initial semantic vector; Step S6: Use a bidirectional recurrent neural network to perform contextual modeling on the sequence embedding matrix and generate the sequence feature matrix. This serves as the input for subsequent cross-modal collaborative attention mechanisms; Step S7: Extract the graph-level structure feature vectors With node-level basic features Perform the concatenation operation to obtain the enhanced node feature matrix. Then, a graph convolutional network is used to enhance the feature matrix. Perform iterative evolution and output the graph structure feature matrix. ; Step S8: Process the sequence feature matrix generated in step S6 The graph structure feature matrix generated in step S7 Interactive processing is performed to generate an enhanced sequence feature matrix. With the enhanced graph feature matrix And a sequence attention weight vector representing the degree of contribution of each token unit to the global vulnerability. ; Step S9: The enhanced feature matrix generated in step S8... and Perform global pooling and feature fusion to generate a comprehensive feature vector. ; Step S10: Combine the feature vectors The input is fed into a classification network consisting of a fully connected layer and a Softmax activation function. The probability result P of the vulnerability is calculated. If the probability result P exceeds the preset judgment threshold, the current code slice is judged to have a vulnerability risk, the vulnerability detection is completed and the subsequent localization process is triggered.

[0007] Furthermore, step S2 specifically involves: presetting a vulnerability syntax rule set. ,in, Guidelines for using pointers As a function calling guideline, Guidelines for using arrays Based on the arithmetic expression criteria, traverse the code nodes in the PDG. Using matching functions Determine the node attributes; if a match is found, mark the node as a Vulnerability Point of Interest (VPoI).

[0008] Furthermore, step S3 specifically includes: Step S3.1: Starting from the Vulnerable Point of Interest (VPoI), perform bidirectional tracing along the data dependency edge and control dependency edge on the PDG to obtain the set of nodes associated with the vulnerability logic. ; Step S3.2: Set the node set The corresponding code statements are sorted in ascending order according to their physical line numbers in the original code, generating a code slice sequence. ; Step S3.3: Based on the node set And its edge connections in the original PDG, induce the generation of the corresponding PDG subgraph. ; Step S3.4: Establish the physical mapping sub-table of mapping index table L The expression is: ; in, For the extracted code node set, For the set of the first One code node, This is the starting physical row number corresponding to this node.

[0009] Furthermore, step S4 specifically involves: performing a consistent mapping on the code attribute of the code slice sequence and PDG subgraph nodes, mapping custom variable names to sequential number placeholders according to their order of appearance. Map the custom function name to Map numeric constants in the code to placeholders Map string constants to placeholders .

[0010] Furthermore, step S5 specifically includes: Step S5.1: Convert the code slice sequence after normalization in step S4 into a token sequence, and use the word segmentation offset to append a sub-table recording the affiliation relationship of the code node to which each token unit belongs to the mapping index table L. The expression is: ; in, For the first slice in the sequence Each token unit This indicates the code node identifier to which the token belongs, determined by the word segmentation position offset. ; Step S5.2: Use the trained Word2vec model to map each token obtained in step S5.1 to a dimension of... eigenvectors; Step S5.3: Set a fixed length The dimension is generated by truncation or zero-padding. The sequence embedding matrix, denoted by time step. The embedding vector is ; Step S5.4: Extract each node from the subgraph The code attribute text is processed and converted into a token subsequence according to the same word segmentation rules as in step S5.1. Using the trained Word2Vec model, each token within a node is mapped to... The feature vector is calculated by averaging the values ​​of all token vectors within a node, which is then used as the initial semantic vector for that node.

[0011] Furthermore, step S6 specifically involves: inputting the sequence embedding matrix generated in step S5.3 into the forward and reverse LSTM layers respectively, for each time step... The forward and backward hidden states are concatenated to obtain the comprehensive semantic feature vector at that position. The stacked vectors at all times form a dimension of Sequence feature matrix , ,in is the dimension of the hidden unit of the LSTM.

[0012] Furthermore, step S7 specifically includes: Step S7.1: Encoding the splicing node type Normalized positional features The node semantic vectors generated in step S5.4 form the basic features. ; Step S7.2: Calculate the subgraph The topological features constitute the graph-level structure feature vectors The features include basic topological features and centrality features; Step S7.3: Convert the normalized graph-level structure feature vectors Broadcast to every node in the subgraph and link it to the node-level basic features. Perform the concatenation operation to obtain the enhanced node feature representation. The representation vector of each node after enhancement processing The matrix formed by vertically stacking constitutes the enhanced node feature matrix. ; Step S7.4: [The text appears to be incomplete and contains several grammatical errors. A more accurate translation would require the full context.] Input GCN, based on subgraph adjacency matrix pass Perform feature evolution and output a graph structure feature matrix that incorporates global topological properties. ;in, It is an adjacency matrix with self-connections. For degree matrix, For the first Features of the layer , For trainable weight matrix, It is a non-linear activation function.

[0013] Furthermore, step S8 specifically includes: Step S8.1: Convert the sequence feature matrix With graph feature matrix Mapping to the latent space dimension generates their respective query matrix, key matrix, and value matrix: ; ; Step S8.2: Calculate the bidirectional attention score matrix between the sequence mode and the graph mode to obtain the sequence-to-graph affinity matrix. and the affinity matrix of the graph pair sequence : ; Step S8.3: Use the affinity matrix to perform weighted reconstruction of heterogeneous modal features to generate an enhanced sequence feature matrix. With the enhanced graph feature matrix : ; Step S8.4: Affinity matrix Perform row-wise aggregation operations to generate a sequence attention weight vector representing the global contribution of each token unit to the vulnerability. : ; in, The numerical value represents the first The saliency score of each token unit after combining graph structure features.

[0014] Furthermore, step S9 specifically involves: for dimension... Enhanced sequence feature moments The matrix performs a global average pooling operation to generate a fixed-dimensional sequence of global feature vectors. For dimension Enhanced graph structure feature matrix execution Perform global max pooling to generate a fixed-dimensional graph global feature vector. ,Will and Perform horizontal merging to generate a comprehensive feature vector. , The dimension is .

[0015] Furthermore, the localization process in step S10 specifically involves: extracting the sequence attention weight vector generated in step S8. Based on the attribution sub-table, the weight scores of all Token units belonging to the same code node are summed to calculate the weight score of each code node. energy value : ; Sort all code node energy in descending order of value, and filter those that meet the energy accumulation threshold. Minimum set of code node indices : ; Based on physical mapping subtable , will set The index backtracking in the middle is the set of physical row numbers. It outputs the results, enabling the location of the vulnerability.

[0016] The beneficial effects of this invention are: (1) This invention achieves “semantic alignment” between sequence semantics and topological structure by introducing a collaborative attention mechanism, which enables the method of this invention to dynamically adjust the attention to lines of code according to the program logic structure, effectively solves the feature dilution problem caused by insufficient modality fusion, and significantly enhances the ability to capture hidden logic vulnerabilities.

[0017] (2) When extracting graph features, this invention not only focuses on local adjacency relationships, but also introduces global graph-level indicators such as degree matching and PageRank, which overcomes the "over-smoothing" problem that is easy to occur in ordinary graph neural networks and further improves the accuracy of identifying complex data dependency vulnerabilities.

[0018] (3) By extracting slices of VPoI for sensitive operations such as pointers, arrays, and system calls, redundant code unrelated to the vulnerability in the function is eliminated. This not only significantly reduces computational overhead but also allows focusing on the critical path that triggers the vulnerability, thus improving the signal-to-noise ratio from the data source.

[0019] (4) Compared with multi-task learning methods that require a large number of node labels, this invention extracts the root cause of the vulnerability directly from the decision logic through attention weight backtracking technology. This method not only reduces the cost of sample labeling, but also the location results are highly consistent with the predictions, and has stronger technical interpretability. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart of the method of the present invention; Figure 2 This is a schematic diagram of the cross-modal collaborative attention mechanism. Detailed Implementation

[0022] To facilitate understanding by those skilled in the art, the present invention will be further described below with reference to embodiments and accompanying drawings. The content mentioned in the embodiments is not intended to limit the present invention.

[0023] like Figure 1 As shown, this invention provides a source code vulnerability detection and localization method based on a cross-modal collaborative attention mechanism, comprising the following steps: Step S1: Obtain the source code data to be tested, and use the Joern tool to parse the source code into an abstract syntax tree and a control flow graph to generate a program dependency graph (PDG). This embodiment first obtains the source code function to be tested. Using the Joern tool, the source code is parsed into an Abstract Syntax Tree (AST) and a Control Flow Graph (CFG), and further data dependencies and control dependencies are extracted to generate a PDG. In the PDG, nodes represent statements or expressions, and edges represent variable passing or logical control paths.

[0024] Step S2: Identify key node VPoIs in the program dependency graph PDG according to the preset vulnerability interest point rules; The system retrieves VPoIs from PDG nodes using a pre-defined heuristic rule base. The VPoIs of this invention are categorized into four types: 1. Sensitive API / Library Function Calls: Retrieves nodes containing calls to security-sensitive functions such as strcpy, gets, malloc, and free. 2. Array Usage: Locates all nodes involving array index access, focusing on identifying index operations lacking boundary checks. 3. Pointer Usage: Retrieves nodes involving pointer dereferencing, pointer arithmetic operations (such as offset calculations), and references after memory release. 4. Arithmetic Expressions: Identifies nodes involving addition, multiplication, and bit shift operations whose results are used for memory allocation or index calculations, monitoring for potential integer overflows.

[0025] Further explanation is needed regarding step S2.1: Defining the rule set: Preset vulnerability syntax rule cluster. ,in Guidelines for using pointers As a function calling guideline, Guidelines for using arrays For arithmetic expression criteria; Step S2.2: Node Matching: Traverse the code nodes in the PDG and use the matching function. Determine the node attributes; if a match is found, mark the node as a Vulnerability Point of Interest (VPoI).

[0026] Step S3: Starting with the VPoI node, obtain the set of nodes associated with the vulnerability logic. ,Will Perform ascending sorting and induction to generate code slice sequence S and local PDG subgraphs. At the same time, a physical mapping sub-table is established for the mapping index table L. ; Specifically, step S3.1: Starting from the vulnerability point of interest (VPoI), perform bidirectional tracing along the data dependency edge and control dependency edge on the PDG to obtain the set of nodes associated with the vulnerability logic. ; Step S3.2: Set the node set The corresponding code statements are arranged in ascending order according to their physical line numbers in the original code, generating a code slice sequence. ; Step S3.3: Based on the node set And its edge connections in the original PDG, induce the generation of the corresponding PDG subgraph. This is to achieve row-level mapping alignment between sequence modes and graph modes in physical space; Step S3.4: Establish a mapping index table Physical mapping sub-table This is used to record the one-to-one mapping relationship between each code node in the node set and its physical line number in the original code file, and its representation formula is: ; in, For the extracted code node set, Let be the i-th code node in the set. This is the starting physical row number corresponding to this node.

[0027] Step S4: Process the code slice sequence S and the program dependency graph PDG subgraph. Perform consistency mapping on the middle node code to obtain the normalized code slice sequence and the node code attribute text; To eliminate the interference of coding style and redundant information on the model, user-defined variable names are mapped to... (e.g., `int a+b = 0;` is mapped to `int VAR1+VAR2 = 0`), mapping the custom function name to... Ensure the model focuses on logical structure rather than naming conventions. For constants, replace specific integer and floating-point values ​​with... Replace string literals with .

[0028] Specifically, step S4.1: Before feature embedding, perform a consistency mapping on the "code" attribute of the code slice sequence and PDG subgraph nodes, mapping the custom variable names to sequential number placeholders according to their order of appearance. Map the custom function name to ; Step S4.2: Map numeric constants in the code to placeholders Map string constants to placeholders ; To ensure that the same identifier or constant is treated as a completely consistent text representation in both sequence and graph modalities, consistency checks are performed to eliminate differences in coding styles and reduce interference from non-semantic content.

[0029] Step S5: Convert the normalized code slice sequence and node code attribute text into a token sequence and a token subsequence, and append the attribution relationship subtable to the mapping index table L. The trained Word2vec model is used to map each token to a dimension of . The feature vectors are used to form the sequence embedding matrix and the initial semantic vector; Specifically, step S5.1: Convert the normalized code slice sequence from step S4 into a token sequence. During the word segmentation process, the start and end indices of each token in the original physical row are obtained in real time. Using the offsets mentioned above, the physical row number of the token is retrieved, and combined with the physical mapping sub-table established in step S3.4. (This table records the physical line number and PDG code node identifier) (correspondence relationship), construct the attribution relationship sub-table This allows us to determine the code node to which the token belongs.

[0030] ; in, For the first slice in the sequence Each token unit This indicates the code node identifier to which the token belongs, determined by the word segmentation position offset. .

[0031] Step S5.2: Obtain a large-scale source code corpus and perform the same normalization mapping process as in Step S4, using this as the training sample set; then train the Word2Vec model, constructing a dedicated word vector space by learning the distribution patterns of the mapped identifiers in the code context. Finally, use this trained Word2vec to map each token obtained in Step S5.1 to a dimension of... eigenvectors.

[0032] Step S5.3: Sequence regularization. Set a fixed length. The dimension is generated by truncation or zero-padding. The sequence embedding matrix, denoted by time step. The embedding vector is ; Step S5.4: Node initialization. Extract each node from the subgraph. The "code" attribute text is processed and converted into a token subsequence according to the same word segmentation rules as in step S5.1; subsequently, the Word2Vec model trained in step S5.2 is used to map each token within the node to... The feature vector is calculated using a dimensional feature vector; finally, the average value of all token vectors within a node is calculated using the mean pooling strategy, and this average value is used as the initial semantic vector of that node (dimensional 1). ).

[0033] Step S6: Use a bidirectional recurrent neural network to perform contextual modeling on the sequence embedding matrix and generate the sequence feature matrix. This serves as the input for subsequent cross-modal collaborative attention mechanisms; Specifically, the sequence embedding matrix generated in step S5.3 is input into the forward and reverse LSTM layers respectively. It should be further explained that the forward state calculation involves calculating the time step using a forward LSTM layer. Hidden state: ; Reverse state computation: calculating time using a reverse LSTM layer Hidden state: ; For each moment The forward and backward hidden states are concatenated to obtain the comprehensive semantic feature vector at that position. Finally, the sequence feature matrix is ​​constructed by stacking the vectors from all time points. Its dimensions are ,in This represents the number of hidden layer neurons in a unidirectional LSTM. This matrix... The temporal characteristics of the code slices are fully preserved, serving as input for subsequent cross-modal collaborative attention mechanisms.

[0034] Step S7: Extract the graph-level structure feature vectors With node-level basic features Perform the concatenation operation to obtain the enhanced node feature matrix. Then, a graph convolutional network is used to enhance the feature matrix. Perform iterative evolution and output the graph structure feature matrix. ; Specifically, step S7.1: Construct basic node features. Concatenate node type encoding. Normalized positional features The node semantic vectors generated in step S5.4 form the basic features. ; It should be further explained that the semantic vector is the node semantic vector generated in step S5.4; Node type encoding: One-hot encoding is performed on the statement type of the node (such as assignment statement, conditional judgment, function call, etc.); Location features: Obtain the relative line number of the code corresponding to the node within the slice and perform normalization processing. Concatenate the above information to obtain the basic features of the node, which can characterize the individual attributes of the code node from multiple dimensions.

[0035] Step S7.2: Extract complex features of the graph-level structure. Calculate the subgraph. The topological features constitute the global vector The features include: Basic topological features include: total number of nodes, total number of edges, edge density, and calculation of the mean and variance of the degree sequence. Degree isomatch is used to measure whether nodes with similar degrees tend to connect to each other, characterizing the aggregation pattern of the code logic.

[0036] Centrality characteristics: Calculate the betweenness centrality and PageRank value of each node. Betweenness centrality reflects the frequency with which a node is a logically necessary path, while the PageRank value quantifies the weight distribution of the node in the control flow / data flow, thereby identifying key logical hubs.

[0037] The aforementioned basic topological features and centrality statistical features are concatenated and normalized to form a graph-level global structural feature vector. .

[0038] Step S7.3: Construct the enhanced node feature matrix. To enable the model to have a "global perspective" when processing local nodes, feature enhancement is performed. This operation "injects" the logical complexity information of the entire graph into each node, allowing subsequent convolutional operations to perceive the relative position of the current node within the entire complex program structure. The normalized graph-level structure feature vector is then used... Broadcast to every node in the subgraph and link it to the node-level basic features. Perform the concatenation operation to obtain the enhanced node feature representation. This forms the enhanced node feature matrix. ; Step S7.4: Graph convolution extraction. [The text abruptly ends here, likely due to an incomplete sentence or a formatting error.] Input GCN, based on subgraph adjacency matrix pass Perform feature evolution and output a graph structure feature matrix that incorporates global topological properties. .in, It is an adjacency matrix with self-connections. For degree matrix, For the first Features of the layer , For trainable weight matrix, It is a non-linear activation function.

[0039] Step S8: Use the collaborative attention mechanism to process the sequence feature matrix generated in step S6 and the graph structure feature matrix generated in step S7 to perform interactive processing, generating an enhanced sequence feature matrix and an enhanced graph feature matrix , as well as a sequence attention weight vector representing the degree of global contribution of each Token unit to the vulnerability ; The principle of the collaborative attention mechanism is as Figure 2 shown

[0040] It should be further noted that in step S8.1: Map the sequence feature matrix and the graph feature matrix to the hidden space dimension , generating their respective query matrices, key matrices and value matrices: ; ; where is a learnable weight matrix

[0041] Step S8.2: Calculate the bidirectional attention score matrix between the sequence modality and the graph modality to obtain the affinity matrix of the sequence to the graph and the affinity matrix of the graph to the sequence : ; where is the scaling factor, represents the association strength between the th Token and the th graph node; Step S8.3: Use the affinity matrix to perform weighted reconstruction on the heterogeneous modality features, generating an enhanced sequence feature matrix and an enhanced graph feature matrix : ; Through this interaction mechanism, the deep fusion of sequence semantic features and graph structure topological features is achieved; Step S8.4: Perform row-wise aggregation operation on the affinity matrix to generate a sequence attention weight vector representing the degree of global contribution of each Token unit to the vulnerability : ; where, the value of represents the significance score of the th Token unit after combining graph structure features

[0042] Step S9: The enhanced feature matrix generated in step S8... and Perform global pooling and feature fusion to generate a comprehensive feature vector. ; Specifically, step S9.1: For dimension... Enhanced sequence feature matrix Perform global average pooling. During the computation, the sequence is... The mean of all latent vectors in the dimension is taken to smooth out syntactic redundancy and preserve the macroscopic semantic distribution of code slices. After calculation, a fixed-dimensional sequence global feature vector is generated. .

[0043] Global max pooling for graph modes: for dimensions of Enhanced graph structure feature matrix Perform a global max-pooling operation. This operation extracts... The maximum response of each node in each dimension is used to capture the most significant topological anomalies in the program dependency graph. After calculation, a fixed-dimensional global feature vector of the graph is generated. .

[0044] Step S9.2: Use the vector concatenation operator to... and The code is merged to generate a comprehensive feature vector representing the semantic and structural information of the entire code. ;in, , , .

[0045] Step S10: Combine the feature vectors The input is fed into a classification network consisting of a fully connected layer and a Softmax activation function. The probability result P of the vulnerability is calculated. If the probability result P exceeds the preset judgment threshold, the current code slice is judged to have a vulnerability risk, the vulnerability detection is completed and the subsequent localization process is triggered.

[0046] Specifically, step S10.1: The comprehensive feature vector generated in step S9.2 is... The input is fed into a classification network consisting of fully connected layers and a softmax activation function. The fully connected layers map the features to a two-dimensional space through a linear transformation, and then the softmax function calculates the probability that the slice of the function to be detected contains a vulnerability. If the probability result If the preset threshold is exceeded, the current code slice is determined to have a vulnerability risk, and the subsequent location process is triggered.

[0047] Step S10.2: For the vulnerability sample, extract the sequence attention weight vector generated in step S8. This vector represents the saliency score of each token unit after incorporating graph structure features. Based on the attribution subtable... The weight scores of all token units belonging to the same code node are summed to calculate the weight score of each code node. energy value : ; Step S10.3: Sort all code node energies in descending order of numerical value, and filter those that meet the energy accumulation threshold. Minimum set of code node indices : ; And based on the physical mapping sub-table , will set The index backtracking in the middle is the set of physical row numbers. And output the results. This is to enable the classification and location of vulnerabilities.

[0048] The following examples provide further details.

[0049] Example 1: This embodiment provides a source code vulnerability detection and localization method based on a cross-modal collaborative attention mechanism. Specifically, it includes the following: (1) Data preparation and preprocessing: C / C++ source code was collected from open-source communities and public vulnerability databases (NVD, SARD), and classic vulnerability detection dataset files were selected, as shown in Table 1. The data was deduplicated and standardized, and vulnerability tags were added. The static analysis tool Joern was used to parse the function logic and construct a PDG containing data dependencies and control dependencies. Based on preset vulnerability sensitivity rules, key node VPoIs were identified in the PDG as anchor points for slice extraction.

[0050] Table 1: Dataset ; (2) Centered on VPoI, extract relevant code slice sequences and simultaneously extract subgraphs containing all slice statements and their direct dependencies in PDG. In this embodiment, a function containing a vulnerability can generate multiple complementary "sequence-subgraph" sample pairs due to the existence of multiple points of interest. At the same time, during the extraction process, the system automatically records the physical line number of each code node in the original file, forming a physical mapping subtable. .

[0051] (3) Rename identifiers and abstract constants for the text. Use the Word2vec model for text embedding. At the same time, add a record to the mapping index table to record which code node each token belongs to, forming a sub-table of attribution relationships. .

[0052] (4) Input the sequence embedding matrix into the Bi-LSTM network to extract contextual semantic features; simultaneously utilize the GCN network to fuse node features and subgraph global topological features to generate a graph feature matrix. Then, perform cross-modal co-attention interaction: introduce an asymmetric dual-path projection mechanism to map sequence and graph features to a unified latent space. By calculating the bidirectional affinity matrix, dynamic interaction between modalities is achieved. During this process, the system automatically calculates and saves the sequence attention weight vector. .

[0053] (5) Perform global average pooling on the enhanced sequence features and global max pooling on the graph features, and fuse them to generate a comprehensive feature vector. Input the comprehensive feature vector into the classifier and output the vulnerability detection results.

[0054] (6) For samples identified as vulnerabilities, extract vectors. Sub-table of attribution relationships Calculate each code node energy value Through physical mapping sub-tables The index of the highest-energy critical node is restored to the physical row number to achieve row-level positioning.

[0055] (7) Divide the dataset into training, validation and test sets in a 7:2:1 ratio. Use the training set to jointly train the graph feature extraction network, sequence feature extraction network and co-attention interaction module.

[0056] (8) Process the test set samples through steps S1-S10. Use accuracy, F1-score and localization accuracy (defined as the proportion of samples whose minimum set of code node indices output by the model can successfully cover the real vulnerability root cause line) to measure the model performance, as shown in Table 2.

[0057] Table 2: Experimental Results of Each Method ; Experimental data show that the accuracy of the method in this embodiment is 8.1% higher than that of the single-modal Bi-LSTM and 5.3% higher than that of GCN. This proves that the cross-modal collaborative attention mechanism in step S8 can effectively compensate for the lack of single-modal features. In terms of vulnerability localization, the method in this embodiment achieves a localization accuracy of up to 93.8% through energy backtracking in step S10.2 and the minimum set filtering strategy in step S10.3.

[0058] The above embodiments are preferred implementations of the present invention. In addition, the present invention can be implemented in other ways. Any obvious substitutions without departing from the concept of the present technical solution are within the protection scope of the present invention.

[0059] To facilitate understanding by those skilled in the art of the improvements of this invention over the prior art, some of the accompanying drawings and descriptions have been simplified, and for clarity, some other elements have been omitted from this application. Those skilled in the art should realize that these omitted elements may also constitute the content of this invention.

Claims

1. A source code vulnerability detection and localization method based on cross-modal collaborative attention mechanism, characterized in that, Includes the following steps: Step S1: Obtain the source code data to be tested, and use the Joern tool to parse the source code into an abstract syntax tree and a control flow graph to generate a program dependency graph (PDG). Step S2: Identify key node VPoIs in the program dependency graph PDG according to the preset vulnerability interest point rules; Step S3: Starting with the VPoI node, obtain the set of nodes associated with the vulnerability logic. ,Will Perform ascending sorting and induction to generate code slice sequence S and local PDG subgraphs. At the same time, a physical mapping sub-table is established for the mapping index table L. ; Step S4: Process the code slice sequence S and the program dependency graph PDG subgraph. Perform consistency mapping on the middle node code to obtain the normalized code slice sequence and the node code attribute text; Step S5: Convert the normalized code slice sequence and node code attribute text into a token sequence and a token subsequence, and append the attribution relationship subtable to the mapping index table L. The trained Word2vec model is used to map each token to a dimension of . The feature vectors are used to form the sequence embedding matrix and the initial semantic vector; Step S6: Use a bidirectional recurrent neural network to perform contextual modeling on the sequence embedding matrix and generate the sequence feature matrix. This serves as the input for subsequent cross-modal collaborative attention mechanisms; Step S7: Extract the graph-level structure feature vectors With node-level basic features Perform the concatenation operation to obtain the enhanced node feature matrix. Then, a graph convolutional network is used to enhance the feature matrix. Perform iterative evolution and output the graph structure feature matrix. ; Step S8: Process the sequence feature matrix generated in step S6 The graph structure feature matrix generated in step S7 Interactive processing is performed to generate an enhanced sequence feature matrix. With the enhanced graph feature matrix And a sequence attention weight vector representing the degree of contribution of each token unit to the global vulnerability. ; Step S9: The enhanced feature matrix generated in step S8... and Perform global pooling and feature fusion to generate a comprehensive feature vector. ; Step S10: Combine the feature vectors The input is fed into a classification network consisting of a fully connected layer and a Softmax activation function. The probability result P of the vulnerability is calculated. If the probability result P exceeds the preset judgment threshold, the current code slice is judged to have a vulnerability risk, the vulnerability detection is completed and the subsequent localization process is triggered.

2. The source code vulnerability detection and localization method based on cross-modal collaborative attention mechanism as described in claim 1, characterized in that, Step S2 specifically involves: presetting a vulnerability syntax rule set. ,in, Guidelines for using pointers As a function calling guideline, Guidelines for using arrays Based on the arithmetic expression criteria, traverse the code nodes in PDG. Using matching functions Determine the node attributes; if a match is found, mark the node as a Vulnerability Point of Interest (VPoI).

3. The source code vulnerability detection and localization method based on cross-modal collaborative attention mechanism as described in claim 2, characterized in that, Step S3 specifically involves: Step S3.1: Starting from the Vulnerability Point of Interest (VPoI), perform bidirectional tracing along the data dependency edges and control dependency edges on the PDG to obtain the set of nodes associated with the vulnerability logic. ; Step S3.2: Set the node set The corresponding code statements are arranged in ascending order according to their physical line numbers in the original code, generating a code slice sequence. ; Step S3.3: Based on the node set And its edge connections in the original PDG, induce the generation of the corresponding PDG subgraph. ; Step S3.4: Establish the physical mapping sub-table of mapping index table L The expression is: ； in, For the extracted code node set, For the set of One code node, This is the starting physical row number corresponding to this node.

4. The source code vulnerability detection and localization method based on cross-modal collaborative attention mechanism as described in claim 3, characterized in that, Step S4 specifically involves: performing a consistent mapping on the code attribute of the code slice sequence and PDG subgraph nodes, mapping custom variable names to sequential number placeholders according to their order of appearance. Map the custom function name to Map numeric constants in the code to placeholders Map string constants to placeholders .

5. The source code vulnerability detection and localization method based on cross-modal collaborative attention mechanism as described in claim 4, characterized in that, Step S5 specifically involves: Step S5.1: Convert the code slice sequence after normalization in step S4 into a token sequence, and use the word segmentation offset to append a sub-table recording the affiliation relationship of the code node to which each token unit belongs to the mapping index table L. The expression is: ； in, For the first slice in the sequence Each token unit This indicates the code node identifier to which the token belongs, determined by the word segmentation position offset. ; Step S5.2: Use the trained Word2vec model to map each token obtained in step S5.1 to a dimension of... eigenvectors; Step S5.3: Set a fixed length The dimension is generated by truncation or zero-padding. The sequence embedding matrix, denoted by time step. The embedding vector is ; Step S5.4: Extract each node from the subgraph The code attribute text is processed and converted into a token subsequence according to the same word segmentation rules as in step S5.

1. Using the trained Word2Vec model, each token within a node is mapped to... The feature vector is calculated by averaging the values ​​of all token vectors within a node, which is then used as the initial semantic vector for that node.

6. The source code vulnerability detection and localization method based on cross-modal collaborative attention mechanism as described in claim 5, characterized in that, Step S6 specifically involves: inputting the sequence embedding matrix generated in step S5.3 into the forward and reverse LSTM layers respectively, for each time step... The forward and backward hidden states are concatenated to obtain the comprehensive semantic feature vector at that position. The stacked vectors at all times form a dimension of Sequence feature matrix , ,in is the dimension of the hidden unit of the LSTM.

7. The source code vulnerability detection and localization method based on cross-modal collaborative attention mechanism as described in claim 6, characterized in that, Step S7 specifically involves: Step S7.1: Encoding the splicing node type Normalized positional features The node semantic vectors generated in step S5.4 form the basic features. ; Step S7.2: Calculate the subgraph The topological features constitute the graph-level structure feature vectors The features include basic topological features and centrality features; Step S7.3: Convert the normalized graph-level structure feature vectors Broadcast to every node in the subgraph and link it to the node-level basic features. Perform the concatenation operation to obtain the enhanced node feature representation. The representation vector of each node after enhancement processing The matrix formed by vertically stacking constitutes the enhanced node feature matrix. ; Step S7.4: [The text appears to be incomplete and contains several grammatical errors. A more accurate translation would require Input GCN, based on subgraph adjacency matrix pass Perform feature evolution and output a graph structure feature matrix that incorporates global topological properties. ;in, It is an adjacency matrix with self-connections. For degree matrix, For the first Features of the layer , For trainable weight matrix, It is a non-linear activation function.

8. The source code vulnerability detection and localization method based on cross-modal collaborative attention mechanism as described in claim 7, characterized in that, Step S8 specifically involves: Step S8.1: Convert the sequence feature matrix With graph feature matrix Mapping to the latent space dimension Generate their respective query matrix, key matrix, and value matrix: ； ； Step S8.2: Calculate the bidirectional attention score matrix between the sequence mode and the graph mode to obtain the sequence-to-graph affinity matrix. and the affinity matrix of the graph pair sequence : ； Step S8.3: Use the affinity matrix to perform weighted reconstruction of heterogeneous modal features to generate an enhanced sequence feature matrix. With the enhanced graph feature matrix : ； Step S8.4: Affinity matrix Perform row-wise aggregation operations to generate a sequence attention weight vector representing the global contribution of each token unit to the vulnerability. : ； in, The numerical value represents the first The saliency score of each token unit after combining graph structure features.

9. The source code vulnerability detection and localization method based on cross-modal collaborative attention mechanism as described in claim 8, characterized in that, Step S9 specifically involves: for dimension... Enhanced sequence feature moments The matrix performs a global average pooling operation to generate a fixed-dimensional sequence of global feature vectors. For dimension Enhanced graph structure feature matrix execution Perform global max pooling to generate a fixed-dimensional graph global feature vector. ,Will and Perform horizontal merging to generate a comprehensive feature vector. , The dimension is .

10. The source code vulnerability detection and localization method based on cross-modal collaborative attention mechanism as described in claim 9, characterized in that, The localization process in step S10 specifically involves: extracting the sequence attention weight vector generated in step S8. Based on the attribution sub-table, the weight scores of all Token units belonging to the same code node are summed to calculate the weight score of each code node. energy value : ； Sort all code node energy in descending order of value, and filter those that meet the energy accumulation threshold. Minimum set of code node indices : ； Based on physical mapping subtable , will set The index backtracking in the middle is the set of physical row numbers. It outputs the results, enabling the location of the vulnerability.

Images