A vulnerability positioning method based on vulnerability knowledge graph and context modeling

Abstract

This application relates to the fields of cybersecurity and artificial intelligence technology, specifically disclosing a vulnerability localization method based on vulnerability knowledge graphs and context modeling. It encodes offline vulnerability knowledge graphs and the source code under test as static spatial topological tensors and dynamic temporal evolution tensors, respectively. Structural correlation features and execution state evolution features are extracted through a dual-flow graph neural network. Cross-attention operators and homomorphic mapping constraints are introduced into the network's hidden layer to drive bidirectional information exchange and dynamic calibration between the two heterogeneous features, bridging the representational isolation between static priors and dynamic context. Subsequently, an adaptive masking mechanism filters redundant noise in high-concurrency environments, and the positional importance of each node in the causal propagation chain is used as a differentiated aggregation weight to selectively amplify the discriminative contribution of root cause nodes. Finally, based on the fusion feature vector that condenses causal directional information, probabilistic decoding and coordinate inverse mapping are performed to achieve accurate localization of hidden vulnerability root causes.

Description

Technical Field

[0001] This application relates to the fields of cybersecurity and artificial intelligence, and more specifically, to a vulnerability localization method based on vulnerability knowledge graphs and context modeling. Background Technology

[0002] As the business complexity of power information management systems continues to rise, the security threats faced by core components such as SCADA control platforms, dispatch automation software, and communication gateways are becoming increasingly covert and interconnected. Vulnerability triggering paths often span multiple functional modules and function boundaries. Traditional auditing methods that rely on manual experience to check line by line are no longer sufficient to meet the demand for accurate tracing of such deep and complex security vulnerabilities. Against this backdrop, leveraging the historical vulnerability prior knowledge accumulated from vulnerability knowledge graphs and the dynamic perception capability of execution state through code context modeling technology to construct automated vulnerability localization methods for complex business logic has become a key technical path to improve the efficiency and accuracy of power system security audits.

[0003] However, existing vulnerability localization technologies that combine vulnerability knowledge graphs with code context analysis generally adopt a unidirectional pipeline architecture of "graph retrieval - result assembly - model inference," which has two inherent limitations: First, vulnerability knowledge graphs extract steady-state spatial topological relationships between entities without temporal direction through relational embedding models, while code context modeling captures the temporal evolution characteristics of state as data flows. There is a serious heterogeneous semantic gap between the two at the tensor representation level. Existing methods only fuse them through simple concatenation of vector layers, which cannot restore the dynamic propagation mechanism of vulnerabilities spreading in the code over time. Second, the open-loop unidirectional inference paradigm makes it impossible for the graph to perceive subtle changes in the code execution logic and dynamically adjust the inference subgraph, resulting in rigid localization decisions. Furthermore, in the feature fusion and compression stage, existing methods apply uniformly weighted aggregation operations to all code nodes in the sequence, implicitly assuming that each node makes an equivalent contribution to the vulnerability determination. This causes the weak discriminative signals carried by a small number of key root cause nodes in the vulnerability causal propagation chain to be severely diluted by the features of a large number of irrelevant background nodes, ultimately leading to problems such as ambiguous localization and high false alarm rate.

[0004] Therefore, an optimized vulnerability localization scheme based on vulnerability knowledge graphs and context modeling is desired. Summary of the Invention

[0005] To address the aforementioned technical problems, this application is proposed. Embodiments of this application provide a vulnerability localization method based on vulnerability knowledge graphs and context modeling, comprising: S1, perform graph embedding encoding on the offline vulnerability triple record set to obtain the vulnerability prior topology tensor, and perform syntax parsing, control flow flattening and vectorization processing on the source code text set to be tested to obtain the code temporal evolution tensor. S2, the spatial topological features of the vulnerability prior topological tensor are aggregated by a relational graph convolutional network to obtain the vulnerability spatial topological feature matrix, and the state evolution features of the code temporal evolution tensor are extracted by a graph attention network with time gating to obtain the code execution state feature matrix. S3, perform bidirectional feature exchange and spatial alignment on the vulnerability space topology feature matrix and the code execution state feature matrix to obtain the aligned vulnerability knowledge feature matrix and the aligned code context feature matrix, wherein code nodes that are forced to execute sequentially in time maintain a nearest neighbor distance in the projected static topology space; S4. Perform dimensional concatenation and adaptive mask denoising aggregation on the aligned vulnerability knowledge feature matrix and the aligned code context feature matrix to obtain the spatiotemporal denoised vulnerability feature vector. S5 performs probabilistic decoding on the spatiotemporal noise reduction vulnerability feature vector and reverse mapping with the source code line number to obtain the vulnerability root cause location coordinate sequence.

[0006] Compared with existing technologies, this application proposes a vulnerability localization method based on vulnerability knowledge graphs and context modeling. It maps an offline-constructed vulnerability knowledge graph and the source code under test to a static spatial topological tensor and a dynamic temporal evolution tensor, respectively. A dual-flow graph neural network architecture is used to extract structural correlation features of the graph and execution state evolution features of the code in parallel. Cross-attention operators and homomorphic mapping distance constraints are introduced into the hidden layer of the network to drive bidirectional information exchange and dynamic adaptive calibration of the two heterogeneous features within the tensor space, thereby bridging the representational isolation between static prior knowledge and dynamic execution context. In the feature fusion stage, an adaptive masking mechanism filters redundant scheduling noise in high-concurrency environments, and the positional importance of each node in the causal propagation chain is used as a differentiated aggregation weight to selectively amplify the discriminative feature contributions of root cause nodes and affected nodes, suppressing interference from sideline background nodes and preventing the dilution of key signals in uniform compression. Finally, based on the fusion feature vector that condenses causal directional structural information, execution probability decoding and reverse mapping of source code coordinates are performed to achieve accurate location of hidden vulnerability root causes. Attached Figure Description

[0007] The above and other objects, features, and advantages of this application will become more apparent from the more detailed description of the embodiments of this application in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the embodiments of this application to explain this application and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same components or steps.

[0008] Figure 1 This is a flowchart illustrating a vulnerability localization method based on vulnerability knowledge graph and context modeling according to an embodiment of this application; Figure 2 This is a data flow diagram illustrating a vulnerability localization method based on vulnerability knowledge graph and context modeling according to an embodiment of this application; Figure 3 This is a flowchart illustrating a vulnerability localization method based on vulnerability knowledge graph and context modeling according to an embodiment of this application. The method involves a relational graph convolutional network to aggregate spatial topological features of a vulnerability prior topological tensor to obtain a vulnerability spatial topological feature matrix, and a graph attention network with time gating to extract state evolution features of a code temporal evolution tensor to obtain a code execution state feature matrix. Figure 4 This is a flowchart illustrating a vulnerability localization method based on vulnerability knowledge graph and context modeling according to an embodiment of this application, which involves bidirectional feature exchange and spatial alignment of the vulnerability space topology feature matrix and the code execution state feature matrix to obtain an aligned vulnerability knowledge feature matrix and an aligned code context feature matrix, wherein code nodes that are forced to execute sequentially in time maintain a nearest neighbor distance in the projected static topology space. Figure 5 This is a flowchart illustrating a vulnerability localization method based on vulnerability knowledge graph and context modeling according to an embodiment of this application, which involves dimensional concatenation and adaptive mask denoising aggregation of aligned vulnerability knowledge feature matrices and aligned code context feature matrices to obtain spatiotemporally denoised vulnerability feature vectors. Figure 6 This is a flowchart illustrating a vulnerability localization method based on vulnerability knowledge graphs and context modeling according to an embodiment of this application. The flowchart describes a process for denoising and compressing an initial fused feature tensor to obtain a spatiotemporally denoised vulnerability feature vector based on a global redundant feature filtering mask. Detailed Implementation

[0009] Hereinafter, exemplary embodiments according to this application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this application, and not all embodiments of this application. It should be understood that this application is not limited to the exemplary embodiments described herein.

[0010] As indicated in this application and claims, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" are not specifically singular and may include plural forms. Generally speaking, the terms "comprising" and "including" only indicate the inclusion of explicitly identified steps and elements, which do not constitute an exclusive list, and the method or apparatus may also include other steps or elements.

[0011] While this application makes various references to certain modules of the systems according to embodiments of this application, any number of different modules can be used and run on user terminals and / or servers. The modules described are merely illustrative, and different aspects of the systems and methods may use different modules.

[0012] Flowcharts are used in this application to illustrate the operations performed by the system according to embodiments of this application. It should be understood that the preceding or following operations are not necessarily performed in exact order. Instead, various steps can be processed in reverse order or simultaneously as needed. Furthermore, other operations can be added to these processes, or one or more steps can be removed from them.

[0013] Existing vulnerability localization techniques that combine vulnerability knowledge graphs with code context analysis are generally limited by the heterogeneous semantic gap between static graph topological representations and dynamic code temporal representations, as well as the lack of information feedback in unidirectional pipeline inference architectures. This results in an inability to accurately reconstruct the dynamic propagation mechanism of vulnerabilities in complex business logic scenarios. Furthermore, the uniform weighting of all code nodes during the feature fusion stage leads to a severe dilution of the weak discriminative signals of key root cause nodes in the causal propagation chain by a large number of background nodes, further exacerbating the problems of ambiguous localization and high false positive rates. Therefore, this application proposes a vulnerability localization method based on vulnerability knowledge graphs and context modeling. This method first encodes the offline vulnerability map and the source code under test into a static topological tensor and a dynamic temporal evolution tensor, respectively. Spatial structure correlation features and temporal execution state evolution features are extracted in parallel via a dual-flow graph neural network. Then, a cross-attention operator is constructed in the hidden layer of the network and a homomorphic mapping distance constraint is applied to force temporally continuous code nodes to maintain a nearest neighbor relationship in the static topological projection space, driving the dual-flow heterogeneous features to complete bidirectional information exchange and dynamic adaptive calibration. On this basis, an adaptive masking mechanism is used to filter redundant scheduling noise generated by high-concurrency environments, and the positional importance of each node on the causal propagation link is used as a differential aggregation coefficient to selectively amplify the feature contribution of the root cause node while suppressing the interference of the bypass background node. Finally, based on the fusion feature vector that condenses the causal directional structural information, the execution probability decoding and the reverse mapping of the source code coordinates are performed to output the vulnerability root cause location coordinate sequence.

[0014] Figure 1 This is a flowchart of a vulnerability localization method based on vulnerability knowledge graph and context modeling according to an embodiment of this application. Figure 2 This is a data flow diagram illustrating a vulnerability localization method based on vulnerability knowledge graphs and context modeling according to an embodiment of this application. Figure 1 and Figure 2As shown, a vulnerability localization method based on vulnerability knowledge graph and context modeling according to an embodiment of this application includes: S1, performing graph embedding encoding on an offline vulnerability triplet record set to obtain a vulnerability prior topology tensor, and performing syntax parsing, control flow flattening, and vectorization processing on the source code text set to be tested to obtain a code temporal evolution tensor; S2, performing spatial topology feature aggregation on the vulnerability prior topology tensor through a relational graph convolutional network to obtain a vulnerability spatial topology feature matrix, and performing state evolution feature extraction on the code temporal evolution tensor through a time-gated graph attention network to obtain a code execution state feature matrix. S3, perform bidirectional feature exchange and spatial alignment on the vulnerability space topology feature matrix and the code execution state feature matrix to obtain the aligned vulnerability knowledge feature matrix and the aligned code context feature matrix, where code nodes that are forced to execute sequentially in time maintain nearest neighbor distance in the projected static topology space; S4, perform dimensional concatenation and adaptive mask denoising aggregation on the aligned vulnerability knowledge feature matrix and the aligned code context feature matrix to obtain the spatiotemporal denoised vulnerability feature vector; S5, perform probabilistic decoding and reverse mapping of source code line numbers on the spatiotemporal denoised vulnerability feature vector to obtain the vulnerability root cause location coordinate sequence.

[0015] Specifically, in step S1, the offline vulnerability triplet record set is graph-embedded and encoded to obtain a vulnerability prior topological tensor. The test source code text set is then parsed, control flow flattened, and vectorized to obtain a code temporal evolution tensor. It should be noted that since entity relationships in the vulnerability knowledge graph are stored as discrete symbols, while the execution logic of the source code exists as a sequence of text lines, neither can directly participate in the numerical feature calculations of the downstream neural network. Therefore, the technical solution of this application first performs graph-embedded encoding on the offline vulnerability triplet record set to obtain a vulnerability prior topological tensor, and then performs parsing, control flow flattening, and vectorization on the test source code text set to obtain a code temporal evolution tensor. Through the above processing, heterogeneous data sources can be uniformly transformed into a computable tensor expression, providing a numerical input basis for subsequent dual-stream feature extraction and spatiotemporal alignment.

[0016] More specifically, in a specific example of this application, the offline vulnerability triple record set contains a vulnerability number, a root cause defect code snippet, a vulnerability triggering condition, and an affected component type. Each record constitutes a triple structure of a head entity-relationship-tail entity. For example, the head entity of a record is a buffer overflow vulnerability corresponding to a specific CVE number, the relationship is a triggering condition dependency, and the tail entity is an unvalidated external input assignment statement in the SCADA communication gateway.

[0017] The vector space projection and structural distance error minimization of the offline vulnerability triplet record set converge to obtain the vulnerability prior topological tensor. Specifically, all entities and relations in the triplet record set are initialized as random vectors of fixed dimension, and the structural distance error score of each triplet is calculated based on the translation distance model.

[0018] in, For the multidimensional feature vector of the vulnerability header entity, This represents a multidimensional feature vector representing the association relationship. For the multidimensional feature vector of the vulnerability tail entity, This is the square operation of the L2 norm. The score measures the deviation between the head entity and the tail entity in the vector space after relational translation. The distance error scores of all triples are summed and iteratively minimized using a stochastic gradient descent algorithm, ensuring that entities with real relationships tend to be nearest neighbors in space, while unrelated entities are kept apart. After model convergence, the final feature vectors of all vulnerable entity nodes are arranged and combined according to a preset dimension to generate a vulnerability prior topological tensor.

[0019] The source code text set under test is parsed and its execution time sequence flattened to obtain a flattened flattened control flow graph. Specifically, the compiler frontend is invoked to perform lexical and syntactic analysis on the C / C++ files of the power business source code under test, generating the corresponding abstract syntax tree. Conditional branch nodes and jump instructions are extracted to establish directed edges with execution directions between basic blocks, forming an initial control flow graph. Subsequently, a depth-first traversal is performed along the reachable paths of the initial control flow graph. Each basic block is assigned an increasing absolute time step label according to the order of traversal arrival, losslessly flattening the multi-branch graph structure into a one-dimensional node sequence with a time step order, resulting in the flattened flattened control flow graph.

[0020] Semantic vectorization and absolute temporal step encoding are superimposed on each code node in the flattened time-sequence control flow graph to obtain the code temporal evolution tensor. Specifically, the lexical tag sequence of each code node in the flattened time-sequence control flow graph is embedded into the network layer and mapped to an initial semantic feature vector of fixed dimension. To preserve the absolute temporal position information of the node in the execution chain, for the first... The position of the first time step and the first Each dimension index is used to calculate the sine and cosine positional codes and add them element-wise to the initial semantic feature vector:

[0021]

[0022] in, For the first code nodes at each location The initial semantic feature vector after mapping via the word embedding network, This represents the absolute time step position number of the current node. This refers to the dimension step index within the feature vector. Define the total dimension for feature embedding in the network. Stack and concatenate the encoded feature vectors from all time steps along the temporal dimension to generate the code temporal evolution tensor.

[0023] Specifically, in step S2, a spatial topological feature aggregation is performed on the vulnerability prior topological tensor using a relational graph convolutional network to obtain a vulnerability spatial topological feature matrix, and a state evolution feature extraction is performed on the code temporal evolution tensor using a time-gated graph attention network to obtain a code execution state feature matrix. It should be noted that, given that the vulnerability prior topological tensor carries a static spatial relationship structure between entities without temporal direction, while the code temporal evolution tensor carries a dynamic sequence of state changes along the control flow link and with the data flow, there is an essential difference in the physical properties of their feature representations. Therefore, they need to be independently encoded using feature extraction paradigms that match their data structures. Based on this, the technical solution of this application further uses a relational graph convolutional network to perform spatial topological feature aggregation on the vulnerability prior topological tensor to obtain a vulnerability spatial topological feature matrix, and uses a time-gated graph attention network to extract state evolution features from the code temporal evolution tensor to obtain a code execution state feature matrix. Through the above processing, it is possible to capture the multi-hop topological association semantics between vulnerable entities in the static spatial flow, and retain the state transition memory of the code execution link in the dynamic temporal flow, providing semantically sufficient and structurally independent dual-stream feature input for subsequent cross-alignment steps.

[0024] Figure 3 This document presents a flowchart illustrating a vulnerability localization method based on vulnerability knowledge graphs and context modeling, according to an embodiment of this application. The method involves a relational graph convolutional network to aggregate spatial topological features of a vulnerability prior topological tensor to obtain a vulnerability spatial topological feature matrix, and a time-gated graph attention network to extract state evolution features of a code temporal evolution tensor to obtain a code execution state feature matrix. Figure 3 As shown, step S2 includes: S21, based on a relational graph convolutional network, performing static spatial flow graph convolutional topological feature aggregation on the vulnerability prior topological tensor to obtain a vulnerability spatial topological feature matrix; S22, using a time-gated graph attention network, performing dynamic temporal flow gated attention state extraction on the code temporal evolution tensor to obtain a code execution state feature matrix.

[0025] In step S21, based on a relational graph convolutional network, static spatial flow graph convolutional topological features are aggregated on the vulnerability prior topology tensor to obtain a vulnerability space topological feature matrix. It should be noted that since each node in the vulnerability prior topology tensor only contains local feature information initialized by graph embedding, and its multi-hop association semantics with adjacent vulnerability entities in the graph topology structure have not yet been integrated, it cannot directly reflect the global structural dependencies between vulnerability type, root cause defects, and affected components. Therefore, the technical solution of this application further uses a relational graph convolutional network to aggregate static spatial flow graph convolutional topological features on the vulnerability prior topology tensor to obtain a vulnerability space topological feature matrix. Through the above processing, the feature representation of each vulnerability entity node can be integrated with the topological semantic information within its multi-hop neighborhood, providing a structurally sufficient static knowledge representation for subsequent cross-alignment with dynamic code features.

[0026] More specifically, in a concrete example of this application, the vulnerability prior topology tensor is used as the initial state of the input layer nodes of the relational graph convolutional network. For each target vulnerability entity node in the graph, the hidden layer features of its neighboring nodes are aggregated according to different association types. During the forward propagation of each layer of the network, for the target node... In the The feature update calculation for the layer is as follows:

[0027] in, For the target node In the Update the feature vector of the layer. It is the set of all relation types in the graph. In relation Down to target node The set of connected adjacent nodes. The normalization constant is the node. In relationship The total number of neighbors below, For the first Layers for relationships The specific weight matrix to be learned Adjacent nodes In the Hidden feature vectors of the layer For the first The self-loop weight matrix in the layer that is based on the node's own features. This is a non-linear activation function. The calculation process applies independent weight transformations to different types of relational edges in each layer, such as trigger condition dependencies, component influence propagation, and defect code attribution, enabling the aggregation result to distinguish topological associations across different semantic dimensions. After iterative information transmission through multi-layer graph convolution, the final feature vectors of all vulnerable entity nodes are arranged according to a preset dimension, outputting a vulnerability space topological feature matrix.

[0028] In step S22, a time-gated graph attention network is used to extract the code execution state feature matrix by dynamically time-flow-gated attention state extraction from the code temporal evolution tensor. It should be noted that although each node in the code temporal evolution tensor carries semantic and temporal step encoding information, the differentiated attention levels between nodes based on control flow dependencies have not yet been established, nor has the dynamic memory characteristic of the gradual migration of the code execution state along the temporal link been captured. Based on this, the technical solution of this application further uses a time-gated graph attention network to extract the code execution state feature matrix by dynamically time-flow-gated attention state extraction from the code temporal evolution tensor. Through the above processing, the feature representation of each code node can simultaneously encode its spatial neighborhood attention weight in the control flow graph and the historical state migration information accumulated along the execution link, providing dynamic feature input with temporal memory capabilities for subsequent cross-alignment with static vulnerability knowledge.

[0029] More specifically, in a concrete example of this application, the code temporal evolution tensor is imported into a time-gated graph attention network. For each target node in the code execution chain, the attention coefficients between it and its neighboring nodes in the control flow graph are first calculated. For each target code node... Its adjacent code nodes The feature vectors of both are linearly transformed using a shared weight matrix, concatenated along the feature channel dimension, and then multiplied with the learnable attention weight vector. After introducing non-linearity through the LeakyReLU activation function, Softmax normalization is applied along the adjacent node dimension. The calculation formula is as follows:

[0030] in, For the target node For adjacent nodes The normalized attention coefficient, This is the transposed learnable attention weight vector. To share the linear transformation matrix, and Target nodes and adjacent nodes The input feature vector, This is an operator for concatenating feature dimensions. This attention mechanism gives higher aggregation weights to neighboring nodes with strong data dependencies in the control flow, while weakly correlated side-branch nodes are adaptively suppressed. Then, the transformed features of each neighboring node are weighted and summed according to the attention coefficients to obtain the spatial aggregation feature of the current time step. This aggregation feature, along with the hidden state recorded in the previous time step, is then fed into the gate control loop unit for temporal state updates.

[0031] in, This is the dynamic execution state vector of the target node at the i-th time step in the time-series control flow graph after time-series state updates. To control the set of nodes that are structurally adjacent to this node in the flow graph, To execute the historical hidden state vector of the node immediately preceding the previous time step (i.e., the (i-1)th node), GRU internally controls the retention and forgetting ratio of historical states through update and reset gates. After traversing all code nodes in the order of time steps of the unfolded control flow graph to complete the state iteration, the dynamic execution state vectors output by each time step are stacked along the sequence dimension to output the code execution state feature matrix.

[0032] Specifically, in step S3, a bidirectional feature exchange and spatial alignment are performed on the vulnerability space topology feature matrix and the code execution state feature matrix to obtain an aligned vulnerability knowledge feature matrix and an aligned code context feature matrix. Code nodes that are forced to execute sequentially in time maintain a nearest-neighbor distance in the projected static topology space. It should be noted that, given that the vulnerability space topology feature matrix encodes the static structural association semantics between vulnerability entities without temporal direction, while the code execution state feature matrix encodes the dynamic temporal state information that migrates gradually along the control flow link, and since they belong to heterogeneous tensor spaces and lack the ability to perceive and transmit information back to each other, a simple concatenation of vector layers for fusion cannot reconstruct the dynamic triggering mechanism of vulnerability propagation in the code over time and through multiple component jumps. Based on this, the technical solution of this application further performs a bidirectional feature exchange and spatial alignment on the vulnerability space topology feature matrix and the code execution state feature matrix to obtain an aligned vulnerability knowledge feature matrix and an aligned code context feature matrix, where code nodes that are forced to execute sequentially in time maintain a nearest-neighbor distance in the projected static topology space. Through the above processing, static vulnerability prior knowledge and dynamic code execution context can complete bidirectional information exchange and dynamic adaptive calibration in tensor space, bridging the heterogeneous semantic gap between the two. At the same time, homomorphic mapping constraints ensure that temporal continuity is not destroyed after cross-space projection, providing semantically aligned and structurally consistent dual-stream feature representations for subsequent fusion and noise reduction.

[0033] Figure 4This document describes a vulnerability localization method based on vulnerability knowledge graphs and context modeling, according to an embodiment of this application. It involves bidirectional feature exchange and spatial alignment of a vulnerability space topological feature matrix and a code execution state feature matrix to obtain aligned vulnerability knowledge feature matrices and aligned code context feature matrices. The flowchart illustrates how sequentially executing code nodes are forced to maintain nearest-neighbor distances in the projected static topological space. Figure 4 As shown, step S3 includes: S31, calculating the initial cross-attention tensor between the vulnerability space topology feature matrix and the code execution state feature matrix; S32, applying spatial distribution smoothing constraints to the initial cross-attention tensor based on the temporal distance penalty matrix and the regularization constant to obtain the homomorphic constraint attention weight tensor; S33, performing residual bidirectional updates on the code execution state feature matrix and the vulnerability space topology feature matrix to obtain the aligned vulnerability knowledge feature matrix and the aligned code context feature matrix.

[0034] In step S31, the initial cross-attention tensor between the vulnerability space topological feature matrix and the code execution state feature matrix is ​​calculated. It should be noted that since the vulnerability space topological feature matrix and the code execution state feature matrix belong to two independent encoding spaces—static space and dynamic time—it is necessary to quantify the correlation strength distribution of node-by-node pairs between them before performing bidirectional feature exchange to determine which static vulnerability knowledge entities have semantic associations with which dynamic code execution nodes. Based on this, the technical solution of this application further calculates the initial cross-attention tensor between the vulnerability space topological feature matrix and the code execution state feature matrix. Through the above processing, a cross-space mapping weight distribution between static graph nodes and dynamic code nodes can be established, providing the initial attention basis for subsequent application of homomorphic constraints and execution of residual bidirectional updates.

[0035] More specifically, in a concrete example of this application, linear subspace projection is performed on the vulnerability space topological feature matrix and the code execution state feature matrix, respectively. The vulnerability space topological feature matrix is ​​multiplied by the first learnable query parameter matrix to project the features of each vulnerability entity node onto the query subspace, generating a query tensor. The code execution state feature matrix is ​​multiplied by the second learnable key parameter matrix to project the features of each code node onto the key value subspace, generating a key tensor. Subsequently, the matrix dot product between the query tensor and the transpose of the key tensor is calculated, and the result is divided by the square root of the hidden layer feature dimension for numerical scaling to prevent gradient vanishing, yielding the initial cross-attention tensor. The calculation formula is as follows:

[0036] in, The initial cross-attention tensor for output. The vulnerability space topological feature matrix, The first learnable query parameter matrix, This is the feature matrix of code execution state. For the second learnable key parameter matrix, the superscript... This is a matrix transpose operation. The total dimension of feature embedding is defined for the network. Each element in this tensor represents the unnormalized correlation score between a corresponding static vulnerability entity node and a dynamic code execution node; a higher score indicates a stronger potential semantic association between the two.

[0037] In step S32, a spatial distribution smoothing constraint is applied to the initial cross-attention tensor based on the temporal distance penalty matrix and a regularization constant to obtain a homomorphic constrained attention weight tensor. It should be noted that since the initial cross-attention tensor is calculated solely based on feature similarity and does not consider the physical constraint of temporal continuity in the code execution chain, adjacent code nodes may be assigned to vulnerability entities with greater topological distance during cross-space mapping, disrupting the local continuity of the vulnerability propagation path. Therefore, the technical solution of this application further applies a spatial distribution smoothing constraint to the initial cross-attention tensor based on the temporal distance penalty matrix and a regularization constant to obtain a homomorphic constrained attention weight tensor. Through the above processing, it is possible to force sequentially executing code nodes to maintain nearest-neighbor distances after projection onto the static topological space, ensuring that the cross-attention distribution conforms to the physical continuity characteristics of code execution.

[0038] More specifically, in a concrete example of this application, a temporal distance penalty matrix is ​​first constructed based on the absolute time step positions of each code node in the flattened sequential control flow graph. The value of each element in this matrix is ​​equal to the absolute distance difference between the corresponding two code nodes in the time step sequence. The penalty value for temporally adjacent nodes is close to 0, while the penalty value for temporally distant nodes increases linearly with distance. Then, the initial cross-attention tensor is subtracted from the temporal distance penalty matrix scaled by a regularization constant, and a Softmax function is applied along the feature map dimension for probability normalization. The calculation formula is as follows:

[0039] in, For the output homomorphic constrained attention weight tensor, The initial cross-attention tensor calculated in the previous sub-step. To control the regularization constant of the homomorphic constraint strength, The temporal distance penalty matrix is ​​pre-calculated based on the absolute distance of code node time steps, and Softmax is an exponential normalization function executed along a specified dimension. This is achieved by subtracting the time step distance... The scaled penalty matrix results in lower raw scores for code node pairs with large temporal distances before Softmax normalization. After normalization, their attention weights are compressed to smaller values, while temporally adjacent code node pairs retain higher attention weights because the penalty amount approaches 0, thus achieving a smooth spatial distribution effect under homomorphic mapping constraints.

[0040] In step S33, the code execution state feature matrix and the vulnerability space topology feature matrix are updated bidirectionally with residuals to obtain the aligned vulnerability knowledge feature matrix and the aligned code context feature matrix. It should be noted that since the homomorphic constraint attention weight tensor only establishes the mapping weight distribution between the two heterogeneous spaces, it has not yet actually applied the weights to the original feature matrix to complete the physical transfer of information, and one-way injection would cause the receiver to lose its own original encoded information. Based on this, the technical solution of this application further updates the code execution state feature matrix and the vulnerability space topology feature matrix bidirectionally with residuals to obtain the aligned vulnerability knowledge feature matrix and the aligned code context feature matrix. Through the above processing, static vulnerability knowledge and dynamic code context can absorb each other's semantic features while retaining their respective original encoded information, achieving true bidirectional information fusion.

[0041] More specifically, in a concrete example of this application, feature injection and residual accumulation are performed based on the homomorphic constraint attention weight tensor, respectively, from dynamic flow to static flow and from static flow to dynamic flow. In the static flow update direction, the code execution state feature matrix is ​​linearly mapped through the first domain weight parameter matrix, and then multiplied with the homomorphic constraint attention weight tensor execution matrix to aggregate the context state features in the dynamic time flow. The aggregation result is added residually to the original vulnerability space topology feature matrix and then subjected to layer normalization to generate an aligned vulnerability knowledge feature matrix. In the dynamic flow update direction, the homomorphic constraint attention weight tensor execution matrix is ​​transposed, and the vulnerability space topology feature matrix is ​​mapped through the second domain weight parameter matrix and then multiplied with the transposed attention tensor execution matrix to aggregate the graph topology features in the static space flow. The aggregation result is added residually to the original code execution state feature matrix and then subjected to layer normalization to generate an aligned code context feature matrix. The calculation formula for the above bidirectional update is as follows:

[0042]

[0043] in, The output is the aligned vulnerability knowledge feature matrix. The output is the aligned code context feature matrix. The vulnerability space topological feature matrix, This is the feature matrix of code execution state. For the homomorphically constrained attention weight tensor, Transpose it. This is the first range weight parameter matrix when injecting from a dynamic flow to a static flow. The second domain weight parameter matrix is ​​used for feedback from static flow to dynamic flow, and LayerNorm is the layer normalization function. Residual connections ensure that their original features are not overwritten during the update process, and layer normalization stabilizes the feature distribution to avoid internal covariate shift.

[0044] Specifically, in step S4, the aligned vulnerability knowledge feature matrix and the aligned code context feature matrix are subjected to dimensional concatenation and adaptive masking denoising aggregation to obtain a spatiotemporally denoised vulnerability feature vector. It should be noted that, although the aligned vulnerability knowledge feature matrix and the aligned code context feature matrix have completed bidirectional information exchange, they still exist as independent dual-stream matrices and have not yet been merged into a unified feature representation that can be directly consumed by the downstream decoder. Furthermore, in the high-concurrency operation environment of the power information management system, normal framework scheduling calls and heartbeat detection introduce a large amount of redundant noise components unrelated to vulnerability triggering into the feature space. Direct compression without filtering will interfere with the effective transmission of the vulnerability root cause discrimination signal. Based on this, the technical solution of this application further performs dimensional concatenation and adaptive masking denoising aggregation on the aligned vulnerability knowledge feature matrix and the aligned code context feature matrix to obtain a spatiotemporally denoised vulnerability feature vector. Through the above processing, the heterogeneous features of the two streams can be merged into a unified tensor space and the redundant scheduling noise generated by the high-concurrency environment can be filtered out. At the same time, selective aggregation and compression are performed by differentiating the importance weights of each node in the causal propagation link to avoid the discrimination signal of the key root cause node being diluted by a large number of background nodes. The output is a fixed-length feature vector that condenses the causal directional structural information for downstream probabilistic decoding.

[0045] Figure 5 This is a flowchart illustrating a vulnerability localization method based on vulnerability knowledge graphs and context modeling according to an embodiment of this application. It describes the dimensional concatenation and adaptive masking denoising aggregation of aligned vulnerability knowledge feature matrices and aligned code context feature matrices to obtain spatiotemporally denoised vulnerability feature vectors. Figure 5 As shown, step S4 includes: S41, physically combining the aligned vulnerability knowledge feature matrix and the aligned code context feature matrix to obtain an initial fused feature tensor; S42, performing redundancy filter mask estimation based on a multilayer perceptron on the initial fused feature tensor to obtain a global redundancy filter mask; S43, based on the global redundancy filter mask, performing denoising and compression aggregation on the initial fused feature tensor to obtain a spatiotemporally denoised vulnerability feature vector.

[0046] In step S41, the aligned vulnerability knowledge feature matrix and the aligned code context feature matrix are physically concatenated to obtain an initial fused feature tensor. It should be noted that since the aligned vulnerability knowledge feature matrix and the aligned code context feature matrix still independently store static graph semantics and dynamic execution state information, subsequent denoising and aggregation operations need to simultaneously perceive both types of information in a unified feature space to accurately identify redundant noise and valid signals. Based on this, the technical solution of this application further physically concatenates the aligned vulnerability knowledge feature matrix and the aligned code context feature matrix to obtain an initial fused feature tensor. Through the above processing, the dual-stream features can be losslessly merged into the same tensor, enabling each node position to simultaneously carry complete information of both static topological semantics and dynamic temporal state.

[0047] More specifically, in a concrete example of this application, it is confirmed that the aligned vulnerability knowledge feature matrix and the aligned code context feature matrix are completely identical in both batch size and node sequence length dimensions. Using the feature channel dimension as the operation axis, the two are physically concatenated along this dimension, such that the dimension of the merged tensor in the feature channel direction is equal to the sum of the feature dimensions of the two input matrices. In the initial fused feature tensor after concatenation, each row corresponds to a code node or time step position. The first half of the row vector is the topological association feature absorbed from the static vulnerability map at that position, and the second half is the state evolution feature accumulated at that position in the dynamic execution link. The two are physically adjacent in the same row, providing a complete joint input for the subsequent adaptive mask generator to determine whether each feature element belongs to a valid vulnerability signal or redundant scheduling noise.

[0048] In step S42, a redundancy filter mask estimation based on a multilayer perceptron is performed on the initial fused feature tensor to obtain a global redundancy feature filter mask. It should be noted that the initial fused feature tensor contains redundant feature components generated by normal framework scheduling, heartbeat detection, and routine state polling under the high-concurrency operation environment of the power information management system. These noise signals coexist with valid signals related to vulnerability triggering in the feature space. Directly aggregating and compressing them without distinction will interfere with the downstream decoder's identification of the root cause of the vulnerability. Therefore, the technical solution of this application further performs a redundancy filter mask estimation based on a multilayer perceptron on the initial fused feature tensor to obtain a global redundancy feature filter mask. Through the above processing, the correlation between each feature element and redundant scheduling behavior can be adaptively identified, providing an element-wise granular filtering basis for subsequent noise reduction mapping.

[0049] More specifically, in a concrete example of this application, the initial fused feature tensor is input into an adaptive mask generator consisting of two fully connected layers. The first fully connected layer performs a linear mapping on the input tensor and adds a bias term, then truncates negative responses using a ReLU activation function to extract nonlinear combined features; the second fully connected layer performs dimensionality compression mapping on the intermediate features and adds a bias term, then strictly maps the output value to a continuous interval between 0 and 1 using a Sigmoid activation function, as shown in the following formula:

[0050] in, Use a mask to filter out global redundancy features in the output. Let be the initial fused feature tensor as input. This is the learnable weight matrix of the first fully connected layer. For the bias term corresponding to the first layer, This is the learnable weight matrix for the second fully connected layer. This is the bias term corresponding to the second layer, and ReLU is the linear rectified activation function. This is the Sigmoid activation function. In the output mask, the positions with values ​​close to 1 correspond to the valid signal components related to vulnerability triggering, while the positions with values ​​close to 0 correspond to redundant noise signals generated by normal framework scheduling under high concurrency. This mask maintains the same dimensionality as the initial fused feature tensor to support subsequent element-wise denoising operations.

[0051] In step S43, based on the global redundancy feature filtering mask, the initial fused feature tensor is denoised and compressed to obtain a spatiotemporal denoised vulnerability feature vector. It should be noted that, given that the global redundancy feature filtering mask has identified the correlation between each element in the initial fused feature tensor and normal high-concurrency scheduling behavior, but this mask has not yet been actually applied to the feature tensor to complete noise cleaning, and the denoised two-dimensional tensor still needs to be compressed along the sequence dimension into a fixed-length one-dimensional vector acceptable to the downstream fully connected decoder, this compression process needs to avoid applying uniformly weighted aggregation to all code nodes, which would dilute the discrimination signal of key root cause nodes on the vulnerability causal propagation link. Based on this, the technical solution of this application further uses the global redundancy feature filtering mask to denoise and compress the initial fused feature tensor to obtain a spatiotemporal denoised vulnerability feature vector. Through the above processing, based on the completion of feature-level noise cleaning, sequence dimension compression can be performed using the positional importance of each node in the causal propagation link as the differential aggregation coefficient. This selectively amplifies the feature contributions of root cause nodes and affected nodes while suppressing the interference of bypass background nodes, outputting a fixed-length feature vector that condenses the causal directional structural information.

[0052] Figure 6This is a flowchart illustrating the process of denoising and compressing an initial fused feature tensor to obtain a spatiotemporally denoised vulnerability feature vector, based on a global redundant feature filtering mask, according to an embodiment of this application, in a vulnerability localization method based on vulnerability knowledge graphs and context modeling. Figure 6 As shown, step S43 includes: S431, performing element-wise multiplication noise suppression mapping on the initial fused feature tensor and the global redundant feature filtering mask to suppress redundant scheduling noise signal components, thereby obtaining a causal denoising feature matrix; S432, evaluating the importance of causal propagation link positions and normalizing the probability of each node feature in the causal denoising feature matrix to obtain a causal propagation node importance weight vector; S433, using the causal propagation node importance weight vector as a node-wise aggregation coefficient, performing causal weighted summation and compression on the causal denoising feature matrix to selectively amplify the contribution of core node features in the causal link, thereby obtaining a spatiotemporal denoising vulnerability feature vector.

[0053] In step S431, an element-wise multiplication noise suppression mapping is performed on the initial fused feature tensor and the global redundant feature filtering mask to suppress redundant scheduling noise signal components, resulting in a causal denoising feature matrix. It should be noted that feature-level noise cleaning must be performed before performing causal weight learning to avoid noise components interfering with the weight evaluation network's judgment of the importance of real causal link nodes. Based on this, the technical solution of this application further performs an element-wise multiplication noise suppression mapping on the initial fused feature tensor and the global redundant feature filtering mask to suppress redundant scheduling noise signal components, resulting in a causal denoising feature matrix. Through the above processing, feature-level noise cleaning can be completed while maintaining node-level granular information, providing a reliable signal-to-noise ratio basis for subsequent independent evaluation of the importance of each code position in the causal propagation link.

[0054] More specifically, in a concrete example of this application, the initial fused feature tensor and the global redundant feature filtering mask are subjected to Hadamard product operation, i.e., element-wise multiplication of two tensors of the same dimension. Positions in the mask with values ​​close to 0 correspond to redundant noise signals generated by normal framework scheduling under high concurrency. After the product operation, the feature response at these positions is effectively suppressed to near zero. Positions in the mask with values ​​close to 1 correspond to effective signal components related to vulnerability triggering. After the product operation, their feature responses are fully preserved. The result is a causal denoising feature matrix, which maintains a two-dimensional form, i.e., the node sequence length multiplied by the feature channel dimension. Each row strictly corresponds to the denoised feature representation of a code node or time step. In the vulnerability localization scenario, the two-dimensional structure of the matrix is ​​retained instead of being directly compressed to one dimension because subsequent causal weight learning requires independently evaluating the importance of each code position in the causal propagation chain node by node. If pooling compression is performed here, the node granularity information will be irreversibly lost. The calculation formula for this process is as follows:

[0055] in, This represents the output causal denoising feature matrix. This represents the initial fused feature tensor of the input. This represents the input global redundancy feature filtering mask. The Hadamard product operator represents element-wise multiplication.

[0056] In real-world scenarios of vulnerability localization in power SCADA control platforms, a complete control flow chain contains hundreds of code nodes. Many of these nodes correspond to normal operational behaviors such as routine heartbeat detection function calls, periodic status polling, and thread switching logs of high-concurrency task schedulers. These nodes constitute a large proportion of the initial fused feature tensor and generate feature responses unrelated to vulnerability triggering. After Hadamard denoising mapping, the feature responses corresponding to the aforementioned normal scheduling behaviors are suppressed to negligible levels by values ​​approaching 0 in the mask. Meanwhile, the node features truly located on the vulnerability causal propagation chain are fully preserved because the mask value is close to 1. For example, a node in the SCADA communication gateway that has not undergone input validation, and its downstream secondary reference nodes to contaminated variables, maintain clearly discernible response strengths in the denoised causal denoising feature matrix, providing a noise-free input basis for subsequent learning of causal propagation importance weights.

[0057] In step S432, the importance of each node's features in the causal denoising feature matrix is ​​evaluated and its probability is normalized to obtain a causal propagation node importance weight vector. It should be noted that, given that the feature representations of each node in the causal denoising feature matrix already possess a reliable signal-to-noise ratio, the problem at this point is how to quantify the positional importance of each code node in the vulnerability causal propagation chain. However, if a uniformly weighted aggregation strategy is adopted, it implicitly assumes that all code nodes contribute equally to the vulnerability determination. In a long-link code structure containing hundreds of nodes, this would lead to the discrimination signals of a small number of key root cause nodes being diluted by a large number of irrelevant background nodes. Based on this, the technical solution of this application further evaluates and normalizes the causal propagation link importance of each node's features in the causal denoising feature matrix to obtain a causal propagation node importance weight vector. Through the above processing, the causal propagation dependency between nodes can be transformed from implicit knowledge into an explicit differentiable weight distribution, so that the root cause node and the affected node located in the core region of the causal link can obtain a higher weight allocation than the background node, thereby explicitly encoding the causal propagation dependency into a set of adaptive coefficients that can be optimized end-to-end.

[0058] More specifically, in a concrete example of this application, the causal denoising feature matrix is ​​input into a single-layer linear fully connected network. A linear mapping is independently performed on the feature vector of each row (i.e., each node) in the matrix, compressing the high-dimensional feature space into a single scalar score. This score reflects the original assessment value of the current node's positional importance in the vulnerability's causal propagation chain. Subsequently, a normalized exponential function is applied along the node sequence dimension to the scalar scores of all nodes, transforming the original scores into a strict probability distribution, ensuring that the sum of the importance weights of all nodes equals 1. The output is a causal propagation node importance weight vector, whose dimension is equal to the node sequence length, and each element in the vector corresponds to the normalized causal importance weight of a code node. The calculation formula for this step is as follows:

[0059] in, This represents the weight vector of importance of the causal propagation nodes in the output. This represents the input causal denoising feature matrix. The learnable linear mapping weight matrix in the causal importance assessment network is used to project the high-dimensional feature vector of each node into a scalar score. This represents the corresponding learnable bias scalar. This represents the normalized exponential function executed along the node sequence dimension. The normalization constraint ensures that the weight vector forms a strict probability distribution, meaning that the output of the downstream aggregation operation will not fluctuate on a numerical scale due to changes in the number of nodes, thus ensuring the comparability of localization results between code segments of different lengths.

[0060] In vulnerability triggering scenarios of power SCADA control platforms, root cause nodes upstream in the causal chain, such as initial injection points for privilege circumvention and first-level downstream nodes directly affected by their data flow, contribute significantly more to vulnerability assessment than sideline background nodes outside the causal chain, such as regular heartbeat detection function calls. After learning and normalization processing by the aforementioned causal importance assessment network, root cause nodes and affected nodes located at the core of the causal propagation chain receive higher weight allocations in the weight vector than background nodes. Meanwhile, sideline nodes such as regular status check branches and log recording calls, which have no direct causal relationship with vulnerability triggering, are assigned weight values ​​close to zero. This allows subsequent aggregation operations to selectively amplify the characteristics of key nodes based on this weight distribution, rather than performing an indiscriminate averaging of all nodes.

[0061] In step S433, the causal propagation node importance weight vector is used as the node-by-node aggregation coefficient to perform causal weighted summation and compression on the causal denoising feature matrix to selectively amplify the feature contribution of core nodes in the causal link, thus obtaining the spatiotemporal denoising vulnerability feature vector. It should be noted that, given that the causal propagation node importance weight vector has quantified the positional importance of each code node in the vulnerability propagation link into an explicit probability distribution, it is necessary to replace the uniformly weighted global average pooling strategy with this weight as the differential aggregation coefficient to perform sequence dimension compression. This avoids the indiscriminate averaging of key node features at the core position of the causal link with a large number of bypass background node features, which would dilute the root cause discrimination signal. Based on this, the technical solution of this application further uses the causal propagation node importance weight vector as the node-by-node aggregation coefficient to perform causal weighted summation and compression on the causal denoising feature matrix to selectively amplify the feature contribution of core nodes in the causal link, thus obtaining the spatiotemporal denoising vulnerability feature vector. Through the above processing, the key node features at the core of the vulnerability causal propagation link are selectively amplified with high weight values ​​and dominate the numerical distribution direction of the final vector, while the feature contributions of the side background nodes are effectively suppressed under weight constraints approaching zero, and the output is a fixed-length feature vector that retains the causal propagation direction structure information.

[0062] More specifically, in a concrete example of this application, each element in the causal propagation node importance weight vector is used as the aggregation coefficient of the corresponding node, and a weighted sum is performed on each row of the causal denoising feature matrix to achieve the desired result. The denoised feature vectors of each node are multiplied by their corresponding causal importance weights, and then accumulated across all nodes, thus compressing the two-dimensional matrix into a fixed-length one-dimensional vector along the node sequence dimension. Compared to the original uniform average pooling, this weighted summation operation selectively amplifies the features of key nodes at the core of the vulnerability causal propagation chain with their high weight values, dominating the numerical distribution direction of the final vector, while the feature contributions of sideline background nodes are effectively suppressed to a negligible level under the constraint of their near-zero weight values. The output is a spatiotemporally denoised vulnerability feature vector, which serves as the final product of the entire feature fusion and compression main step and is passed to the downstream fully connected classification decoder. The calculation formula for this step is as follows:

[0063] in, This represents the spatiotemporal noise reduction vulnerability feature vector of the output. This represents the total number of nodes or time steps in the causal denoising feature matrix. The first node in the causal propagation node importance weight vector represents the... The normalized causal importance weight scalar value corresponding to each node. The causal noise reduction feature matrix represents the first... The node denoising feature vector corresponding to the row, This operator represents the summation operation performed by traversing all positions along the node sequence dimension. When the causal propagation node importance weight vector degenerates into a uniform distribution, i.e., all weights are equal to... When the formula is mathematically equivalent to the global average pooling operation, the global average pooling can be regarded as a special case of the causal weighted aggregation mechanism under the condition of uniform degradation of causal weights.

[0064] In the practical scenario of vulnerability localization in power information management systems, a typical vulnerability triggering process manifests as a root cause node, such as an unvalidated external assignment statement in a SCADA control module, propagating downstream through data flow dependencies. This propagation passes through secondary reference nodes of contaminated variables and jump entry nodes of abnormal branches, ultimately reaching the vulnerability's explicit exposure point, such as unauthorized execution of instructions or illegal state transitions. This directed propagation path from the root cause to the exposure point constitutes a causal triggering chain. After causal weighted summation and compression, the features of the root cause node and affected nodes located in the core region of this causal triggering chain dominate the numerical distribution of the final spatiotemporal noise-reduced vulnerability feature vector with high weight values. Meanwhile, the feature contributions of numerous background nodes outside the causal chain, such as normal log recording calls and regular state check branches, are suppressed to negligible levels. This allows downstream decoders to more accurately distinguish the true root cause location from bypass nodes with only superficial similarities during probabilistic decoding, reducing false alarm rates and localization offset rates.

[0065] Specifically, in step S5, the spatiotemporal denoising vulnerability feature vector is probabilistically decoded and inversely mapped to source code line numbers to obtain a vulnerability root cause location coordinate sequence. It should be noted that since the spatiotemporal denoising vulnerability feature vector is still in a high-dimensional abstract feature space, it cannot be directly used by security auditors to locate specific source code defects. It needs to be decoded into an interpretable probabilistic judgment result and mapped back to physical code coordinates. Based on this, the technical solution of this application further performs probabilistic decoding and inverse mapping to source code line numbers on the spatiotemporal denoising vulnerability feature vector to obtain a vulnerability root cause location coordinate sequence. Through the above processing, the numerical representation in the abstract feature space can be transformed into source code file paths and line number information with clear physical meaning, outputting vulnerability root cause location results that can be directly used for security auditing and remediation.

[0066] More specifically, in a specific example of this application, the spatiotemporal denoising vulnerability feature vector is first fed into a fully connected classifier decoder network. After linear mapping between the hidden layer weight matrix and the bias term, nonlinear deep feature decoding is performed through the ReLU activation function. Then, after linear mapping between the output layer weight matrix and the bias term, the original node vulnerability judgment log probability sequence is obtained. Each element in this sequence is the unnormalized score of the corresponding candidate code node's vulnerability tendency.

[0067] Subsequently, the logarithmic probability sequence of the original node vulnerability determination was normalized for all nodes. For the [number]th node in the sequence... For each candidate node, calculate the natural exponent of its log-odds as the numerator, and use the total... The normalized trigger probability of a node is obtained by summing the natural exponential values ​​of the log odds of each candidate node, using the numerator as the denominator and dividing the numerator by the denominator. The calculation formula is as follows:

[0068] in, For the first The normalized vulnerability trigger probability score of each candidate node The first node in the log-probability sequence for determining vulnerabilities in the original node The unnormalized log-probability value of each node. This represents the total number of candidate code nodes participating in the decision-making process. This is a natural exponential function. The normalized probability values ​​of all nodes are combined in their original index order to obtain a sequence of node vulnerability trigger probability distributions.

[0069] Finally, based on the preset confidence threshold and the mapping table between node index and physical line number, the node vulnerability trigger probability distribution sequence is processed by screening high-risk nodes and encapsulating the source code coordinates in reverse mapping. The node vulnerability trigger probability distribution sequence is traversed, and candidate node indices with probability values ​​greater than or equal to the preset confidence threshold are selected to construct a set of high-risk candidate nodes. The mapping metadata between node indices and physical line numbers retained in step S1 (syntax parsing stage) is called to convert each selected high-risk node index into its corresponding source code physical file path, function block name, and specific code line number. This is then encapsulated and packaged to generate a vulnerability root cause location coordinate sequence. In the security audit scenario of a power SCADA communication gateway, this coordinate sequence directly points to the specific code line where privilege circumvention or unverified input exists, allowing security operations personnel to perform targeted remediation.

[0070] Specifically, before the end-to-end inference process consisting of steps S1 to S5 is put into actual vulnerability localization, supervised training of the entire network model is required to obtain the optimal values ​​of the learnable parameters of each layer. The training dataset is constructed based on the power industry-related vulnerability records and corresponding source code patches disclosed in the public vulnerability database. Each training sample contains a segment of source code to be tested and the line number of the vulnerability root cause code marked by security experts. The code node corresponding to the marked line number is marked as a positive sample, and the remaining nodes are marked as negative samples, forming a node-level binary classification label sequence. The loss function adopts the binary cross-entropy loss to measure the distribution difference between the node vulnerability trigger probability distribution sequence output by the network and the true label sequence. The calculation formula is as follows:

[0071] in, This represents the overall training loss value. This represents the total number of candidate code nodes participating in the decision-making process in the current sample. For the first The true binary classification label of each node takes the value 0 or 1. For the network prediction of the first The probability of vulnerability triggering at each node is calculated. The optimization strategy employs the Adam adaptive moment estimator optimizer, with an initial learning rate of 0.001 and a weight decay coefficient of 0.0001 to prevent overfitting. Every 20 training epochs, the learning rate is decreased stepwise by multiplying it by a decay factor of 0.5. During training, the loss value calculated on the independent validation set at the end of each epoch is used as the model performance monitoring metric. When the validation set loss value no longer decreases within 10 consecutive training epochs, the model is considered converged, training is stopped, and the model parameter weights corresponding to the lowest validation set loss are saved as the network parameters used for final inference deployment.

[0072] The various embodiments of this disclosure have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or improvement of the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A vulnerability localization method based on vulnerability knowledge graph and context modeling, characterized in that, include: S1, perform graph embedding encoding on the offline vulnerability triple record set to obtain the vulnerability prior topology tensor, and perform syntax parsing, control flow flattening and vectorization processing on the source code text set to be tested to obtain the code temporal evolution tensor. S2, the spatial topological features of the vulnerability prior topological tensor are aggregated by a relational graph convolutional network to obtain the vulnerability spatial topological feature matrix, and the state evolution features of the code temporal evolution tensor are extracted by a graph attention network with time gating to obtain the code execution state feature matrix. S3, perform bidirectional feature exchange and spatial alignment on the vulnerability space topology feature matrix and the code execution state feature matrix to obtain the aligned vulnerability knowledge feature matrix and the aligned code context feature matrix, wherein code nodes that are forced to execute sequentially in time maintain a nearest neighbor distance in the projected static topology space; S4. Perform dimensional concatenation and adaptive mask denoising aggregation on the aligned vulnerability knowledge feature matrix and the aligned code context feature matrix to obtain the spatiotemporal denoised vulnerability feature vector. S5 performs probabilistic decoding on the spatiotemporal noise reduction vulnerability feature vector and reverse mapping with the source code line number to obtain the vulnerability root cause location coordinate sequence.

2. The vulnerability localization method based on vulnerability knowledge graph and context modeling according to claim 1, characterized in that, The offline vulnerability triplet record set contains the vulnerability number, the root cause defect code snippet, the vulnerability triggering conditions, and the type of affected component.

3. The vulnerability localization method based on vulnerability knowledge graph and context modeling according to claim 2, characterized in that, Step S1 includes: The vector space projection and structural distance error minimization convergence of the offline vulnerability triplet record set are performed to obtain the vulnerability prior topological tensor. The code syntax of the source code text set to be tested is parsed and the execution sequence is flattened to obtain the flattened sequence control flow graph. Semantic vectorization and absolute time step encoding are superimposed on each code node in the unfolded time sequence control flow graph to obtain the code temporal evolution tensor.

4. The vulnerability localization method based on vulnerability knowledge graph and context modeling according to claim 1, characterized in that, Step S2 includes: Based on relational graph convolutional networks, static spatial flow graph convolutional topological features are aggregated on the vulnerability prior topological tensor to obtain the vulnerability spatial topological feature matrix. By using a time-gated graph attention network, the code execution state feature matrix is ​​obtained by dynamically extracting the time-series evolution tensor of the code through gated attention.

5. The vulnerability localization method based on vulnerability knowledge graph and context modeling according to claim 1, characterized in that, Step S3 includes: Calculate the initial cross-attention tensor between the vulnerability space topological feature matrix and the code execution state feature matrix; Based on the temporal distance penalty matrix and the regularization constant, the initial cross-attention tensor is subjected to spatial distribution smoothing constraint to obtain the homomorphic constraint attention weight tensor; The code execution state feature matrix and the vulnerability space topology feature matrix are updated bidirectionally with residuals to obtain the aligned vulnerability knowledge feature matrix and the aligned code context feature matrix.

6. The vulnerability localization method based on vulnerability knowledge graph and context modeling according to claim 1, characterized in that, Step S4 includes: The aligned vulnerability knowledge feature matrix and the aligned code context feature matrix are physically spliced ​​together to obtain the initial fused feature tensor. The initial fused feature tensor is subjected to redundancy filter mask estimation based on multilayer perceptron to obtain the global redundancy feature filter mask; Based on the global redundant feature filtering mask, the initial fused feature tensor is denoised and compressed to obtain the spatiotemporal denoising vulnerability feature vector.

7. The vulnerability localization method based on vulnerability knowledge graph and context modeling according to claim 1, characterized in that, Step S5 includes: Nonlinear deep feature decoding and linear mapping of the spatiotemporal noise reduction vulnerability feature vectors are performed on the output layer to obtain the original node vulnerability judgment log probability sequence. The log probability sequence of the original node vulnerability determination is normalized to obtain the node vulnerability trigger probability distribution sequence. Based on a preset confidence threshold and a mapping table between node index and physical line number, the probability distribution sequence of node vulnerability triggering is processed by screening high-risk nodes and encapsulating the source code coordinates in reverse mapping to obtain the vulnerability root cause location coordinate sequence.

8. The vulnerability localization method based on vulnerability knowledge graph and context modeling according to claim 6, characterized in that, Based on a global redundant feature filtering mask, the initial fused feature tensor is denoised and compressed to obtain a spatiotemporal denoising vulnerability feature vector, including: The initial fused feature tensor and the global redundant feature filtering mask are multiplied element-wise to perform noise suppression mapping to suppress redundant scheduling noise signal components, thus obtaining the causal denoising feature matrix. The importance of causal propagation link position and probability normalization of each node feature in the causal denoising feature matrix are evaluated to obtain the causal propagation node importance weight vector. Using the importance weight vector of causal propagation nodes as the node-by-node aggregation coefficient, the causal denoising feature matrix is ​​subjected to causal weighted summation and compression to selectively amplify the feature contribution of core nodes in the causal link, thus obtaining the spatiotemporal denoising vulnerability feature vector.

Images