Code vulnerability detection method and system based on meta-learning and dynamic label correction

Abstract

The application discloses a code vulnerability detection method and system based on meta-learning and dynamic label correction, and belongs to the technical field of computer and information security. First, initial soft labels and sample label information for positive unlabeled learning are obtained. Then, code semantic features are extracted to obtain vulnerability prediction probabilities of a current model. For the soft labels in a training batch, label correction scores of unlabeled samples are generated through inner loop meta-training and outer loop meta-validation feedback. In combination with vulnerability prototype constraints, positive rate capacity truncation and exponential moving average strategies, global soft labels of the unlabeled samples are dynamically updated. Finally, a fixed classification threshold is used to obtain code vulnerability detection results. The application can reduce the influence of label noise on model training, improve the identification ability of hidden vulnerability samples, and balance the recall rate and false alarm control ability of vulnerability detection in the scene where vulnerability labeled samples are limited and potential vulnerabilities are contained in unlabeled samples.

Description

Technical Field

[0001] This invention relates to the field of computer and information security technology, and in particular to a code vulnerability detection method and system based on meta-learning and dynamic label correction. Background Technology

[0002] In software development and maintenance, source code vulnerability detection is a key technical issue in the field of information security. Vulnerabilities can easily lead to security risks such as system crashes, functional abnormalities, information leaks, remote code execution, and data corruption. Efficient and accurate vulnerability detection is of great significance to ensuring the safe and stable operation of software systems.

[0003] In recent years, deep learning technology has been widely used in source code semantic modeling and static vulnerability detection. Methods based on code pre-trained models such as CodeBERT have effectively improved detection accuracy by converting source code into token sequences and learning the semantic features of code context.

[0004] However, existing technologies have significant drawbacks: First, they rely heavily on clean labeled data, making them difficult to adapt to positive unlabeled (PU) learning scenarios. In real-world scenarios, labeling costs are high, and a large number of unlabeled vulnerabilities are misclassified as safe samples, creating label noise and leading to model learning bias. Second, they have poor robustness to class imbalance. Vulnerability samples are sparse, long-tailed classes, and traditional training methods are easily dominated by normal samples, resulting in low vulnerability recall rates. Furthermore, labels are statically set without dynamic correction or constraint mechanisms. Fine-tuning cannot optimize labels based on generalization feedback, and the lack of positive sample ratio constraints easily leads to excessively high false positive rates.

[0005] Furthermore, existing vulnerability detection methods based on pseudo-labels or soft labels typically rely primarily on the model's current predicted probabilities, lacking the utilization of the semantic structure of known vulnerability samples. This makes it difficult to constrain the direction of label correction for unlabeled samples using vulnerability prototype information, resulting in some unlabeled samples that semantically deviate from the vulnerability pattern being incorrectly promoted to potential vulnerability samples. Summary of the Invention

[0006] To address the shortcomings of existing technologies, this invention provides a code vulnerability detection method and system based on meta-learning and dynamic label correction. In complex environments where a large number of unlabeled vulnerabilities exist and positive and negative categories are severely imbalanced, the method dynamically corrects the monitoring signals and effectively controls false alarms, maintaining high-precision vulnerability detection capabilities.

[0007] On the one hand, a code vulnerability detection method based on meta-learning and dynamic label correction is provided, including: Obtain the source code dataset and preprocess it. Construct a positive sample set and an unlabeled sample set based on known vulnerabilities, and generate initial soft labels and sample labeling information for positive unlabeled learning. The preprocessed source code data is input into the feature extraction model to obtain the semantic features of the code and the vulnerability prediction probability of the current model. The initial soft labels in the training batch are dynamically corrected. Temporary task parameters are obtained through inner loop training, and label correction scores are generated through outer loop validation loss feedback. Based on vulnerability prototype constraints, positive rate constraints, and exponential moving average strategies, the label correction score is constrained and smoothly updated to obtain the updated global soft label. The model parameters are optimized based on the updated global soft tags and the vulnerability prediction probabilities output by the current model, and the code vulnerability detection results are obtained based on the trained model.

[0008] Furthermore, the preprocessed source code data is input into the feature extraction model to obtain the code feature sequence and the vulnerability prediction probability of the current model, including the following steps: The preprocessed source code data is input into the pre-trained backbone network to obtain the pooling features extracted by the pre-trained backbone network. Pooled features are input into the meta-adapter layer for high-dimensional feature transformation, and then connected to a linear classifier to obtain the vulnerability prediction probability of the current model.

[0009] Furthermore, the initial soft labels in the training batch are dynamically corrected. Temporary task parameters are obtained through inner loop training, and label correction scores are generated through outer loop validation loss feedback. Specifically, this includes: The initial soft labels of unlabeled samples are dynamically corrected. The dynamic label correction process adopts an optimization method based on bi-level meta-learning to obtain updated global soft labels. Temporary task parameters are obtained based on the inner loop gradient update, and label correction scores are generated based on the outer loop generalization error.

[0010] Furthermore, temporary task parameters are obtained based on inner loop gradient updates, including: A differentiable perturbation term is introduced into the initial soft labels in the training batch to construct the label perturbation; Based on the meta-target soft tag and the vulnerability prediction probability obtained by the current model, calculate the first loss function that supports the soft tag; Based on the first loss function, the model parameters of the meta-adaptation layer, output normalization layer, and classifier are temporarily updated using gradient descent to obtain temporary task parameters.

[0011] Furthermore, a label correction score is generated based on the outer loop generalization error, including: Temporary task parameters are applied to the meta-validation set to calculate the outer loop meta-validation loss, which is used as the second loss function for meta-validation loss feedback. Calculate the gradient of the second loss function with respect to the differentiable perturbation term, and generate a label correction score based on the gradient descent direction.

[0012] Furthermore, based on vulnerability prototype constraints, positive rate constraints, and exponential moving average strategies, the label correction scores are constrained and smoothly updated to obtain updated global soft labels, including: A positive rate constraint mechanism is used to truncate the capacity of the label correction score after the vulnerability prototype constraint. Based on the exponential moving average strategy, the label correction score after capacity truncation is smoothly merged with the historical global soft label to obtain the updated global soft label.

[0013] Furthermore, the model parameters are optimized based on the updated global soft tags and the vulnerability prediction probabilities obtained from the current model, including: The third loss function is calculated by combining the updated global soft tags with the current vulnerability prediction probability. The gradient of the third loss function is calculated using the backpropagation algorithm, and an optimizer with weight decay and gradient pruning mechanisms is used to perform parameter updates, thus completing the global optimization of the model.

[0014] Furthermore, based on the trained model, code vulnerability detection results are obtained, including: Obtain the vulnerability prediction probability of the source code to be detected; use a fixed classification threshold to determine the vulnerability prediction probability. When the vulnerability prediction probability is greater than or equal to the fixed classification threshold, the source code to be detected is determined to have a vulnerability; when the vulnerability prediction probability is less than the fixed classification threshold, the source code to be detected is determined to have no vulnerability.

[0015] On the other hand, a code vulnerability detection system based on meta-learning and dynamic label correction is provided, including: Positive Unlabeled Sample Construction Module: Obtains and preprocesses the source code dataset, constructs a positive sample set and an unlabeled sample set based on known vulnerabilities, and generates initial soft labels and sample labeling information for positive unlabeled learning; Code feature extraction module: Input the preprocessed source code data into the feature extraction model to obtain code semantic features and the vulnerability prediction probability of the current model; Training and Validation Module: Dynamically corrects the initial soft labels in the training batch, obtains temporary task parameters through inner loop training, and generates label correction scores through outer loop validation loss feedback; Soft tag constraint update module: Based on vulnerability prototype constraints, positive rate constraint mechanism and exponential moving average strategy, the tag correction score is constrained and smoothly updated to obtain the updated global soft tag. Vulnerability detection module: Optimizes model parameters based on the updated global soft tags and the vulnerability prediction probabilities obtained from the current model, and obtains code vulnerability detection results based on the trained model.

[0016] Furthermore, an electronic device is also provided, including: Memory, used for non-transitory storage of computer-readable instructions; and Processor, for executing the computer-readable instructions, When the computer-readable instructions are executed by the processor, they perform the method described in the first aspect above.

[0017] The above technical solution has the following advantages or beneficial effects: This invention discloses a code vulnerability detection method and system based on meta-learning and dynamic label correction. First, a source code dataset is acquired and preprocessed. Based on known vulnerability samples, a positive sample set and an unlabeled sample set are constructed to generate initial soft labels and sample labeling information for positive unlabeled learning. Then, a pre-trained code representation model is used to extract semantic features of the code, and the vulnerability prediction probability of the current model is output through a meta-adaptation layer, an output normalization layer, and a classifier. Further, a differentiable perturbation term is introduced for the soft labels in the training batch, and label correction scores for unlabeled samples are generated through inner-loop meta-training and outer-loop meta-validation feedback. The global soft labels of unlabeled samples are dynamically updated by combining vulnerability prototype constraints, positive rate capacity truncation, and exponential moving average strategies. Finally, a fixed classification threshold is used to output the code vulnerability detection results. This invention can reduce the impact of label noise on model training, improve the identification ability of hidden vulnerability samples, and balance the recall and false positive control capabilities of vulnerability detection in scenarios where the number of labeled vulnerability samples is limited and unlabeled samples contain potential vulnerabilities. This effectively reduces the security risks of software systems. Attached Figure Description

[0018] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0019] Figure 1 This is a flowchart of a code vulnerability detection method based on meta-learning and dynamic label correction as described in Example 1; Figure 2 This is a schematic diagram illustrating the specific steps of a code vulnerability detection method based on meta-learning and dynamic label correction as described in Example 1. Detailed Implementation

[0020] It should be noted that the following detailed descriptions are exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0021] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments of the invention. The terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion, for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0022] In this embodiment of the invention, "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Furthermore, in the description of this invention, "multiple" refers to two or more.

[0023] Furthermore, to facilitate a clear description of the technical solutions of the embodiments of the present invention, the terms "first" and "second" are used in the embodiments of the present invention to distinguish identical or similar items with essentially the same function and effect. Those skilled in the art will understand that the terms "first" and "second" do not limit the quantity or execution order, and the terms "first" and "second" are not necessarily different.

[0024] Where there is no conflict, the embodiments and features in the embodiments of the present invention can be combined with each other.

[0025] All data acquisition in this embodiment is carried out in accordance with laws and regulations and with user consent, and the data is used legally.

[0026] Example 1 This embodiment provides a code vulnerability detection method based on meta-learning and dynamic label correction, such as Figure 1 As shown, it includes: Obtain the source code dataset and preprocess it. Construct a positive sample set and an unlabeled sample set based on known vulnerabilities, and generate initial soft labels and sample labeling information for positive unlabeled learning. The preprocessed source code data is input into the feature extraction model to obtain the semantic features of the code and the vulnerability prediction probability of the current model. The initial soft labels in the training batch are dynamically corrected. Temporary task parameters are obtained through inner loop training, and label correction scores are generated through outer loop validation loss feedback. Based on vulnerability prototype constraints, positive rate constraints, and exponential moving average strategies, the label correction score is constrained and smoothly updated to obtain the updated global soft label. The model parameters are optimized based on the updated global soft tags and the vulnerability prediction probabilities output by the current model, and the code vulnerability detection results are obtained based on the trained model.

[0027] This embodiment provides a code vulnerability detection method based on meta-learning and dynamic label correction. The specific steps are as follows: Figure 2 As shown, it includes: S1: Obtain the source code dataset and preprocess it. Based on the known vulnerabilities, construct a positive sample set P and an unlabeled sample set U, and generate initial soft labels and sample labeling information for positive unlabeled learning. S11: Obtain the source code sample and its corresponding sample tag information.

[0028] This embodiment reads the source code text, sample number, and corresponding tag information for each sample in the source code dataset. The sample tag information indicates whether the source code sample is a known vulnerability sample.

[0029] In one implementation, the source code dataset can be stored as a text file or a structured data file, and each sample includes at least a source code fragment and its corresponding label.

[0030] S12: Preprocess the source code dataset.

[0031] Preprocessing of the source code dataset includes: For the read raw source code text, comments unrelated to the code logic and redundant whitespace characters are removed to reduce noise interference with feature extraction. A tokenizer matched with the pre-trained backbone network is called to convert the source code fragments into discrete token sequences.

[0032] In one alternative implementation, the source code text can be cleaned before word segmentation by performing annotation filtering, redundant whitespace character normalization, and other cleaning processes to reduce the impact of irrelevant text noise on feature extraction.

[0033] Preferably, considering the memory limitations and computational efficiency of deep learning models, this embodiment sets a maximum sequence length threshold, such as Max Length = 512. For token sequences exceeding the maximum sequence length threshold, a truncation strategy is used to retain tokens of a fixed length; for token sequences shorter than the maximum sequence length threshold, a padding strategy is used to pad them to a fixed length. Simultaneously, an attention mask matrix of the same length as the input token sequence is generated, where valid token positions are marked as 1 and padded positions as 0. This ensures that the subsequent pre-trained backbone network ignores invalid padded regions when calculating self-attention weights, thereby achieving strict alignment of the multi-dimensional input tensor.

[0034] S13: Construct a set of positive samples and a set of unlabeled samples based on known vulnerabilities.

[0035] This embodiment obtains a pre-divided training set, meta-validation set, validation set, and test set. The training set is used for model parameter optimization and dynamic updating of soft labels; the meta-validation set is used for outer loop meta-validation loss feedback; and the validation and test sets are used for model performance evaluation.

[0036] In the training set, based on a predetermined positive sample retention ratio, a portion of the known vulnerability samples is selected as the labeled positive sample set P, and its observation label is set to 1, while the initial soft label remains 1. The remaining samples not selected as labeled positive samples, together with the original non-vulnerable samples, form the unlabeled sample set U, and its observation label is set to 0, indicating that the sample has not been identified as a vulnerability sample. It should be noted that an observation label of 0 for the unlabeled sample set U only indicates that it has not been identified as a vulnerability sample, and does not necessarily mean that its true label is non-vulnerable; it may still contain potential vulnerability samples.

[0037] To avoid directly treating unlabeled samples as pure negative samples for supervision during the initial training phase, this embodiment sets continuous initial soft labels for unlabeled samples based on the proportion of observed positive samples in the training set. Let... This indicates the proportion of observed positive samples in the training set, then the... The initial soft label for each sample is represented as follows: (1) in, Indicates the first The initial soft labels for each sample, This indicates the proportion of observed positive samples in the training set. Through this method, unlabeled samples are not directly treated as purely negative samples in the early stages of training, but instead participate in subsequent training as continuous soft labels, thereby mitigating the labeling bias introduced by potentially vulnerable samples being incorrectly supervised as safe samples.

[0038] S2: Input the preprocessed source code data into the feature extraction model to obtain the code semantic features and the vulnerability prediction probability of the current model; The feature extraction model includes a pre-trained backbone network, a meta-adaptation layer, an output normalization layer, and a linear classifier. The pre-trained backbone network extracts semantic features from the source code context; the meta-adaptation layer adapts the pre-trained semantic features to a higher-level task; the output normalization layer stabilizes the adapted feature distribution; and the linear classifier outputs vulnerability prediction results, which are vulnerability representation vectors with deep semantic associations.

[0039] The preprocessed source code data is input into the feature extraction model to obtain the code feature sequence and the vulnerability prediction probability of the current model, including the following steps: S21: Input the preprocessed source code data into the pre-trained backbone network to obtain the contextual semantic features of the source code.

[0040] Preferably, the pre-trained backbone network can be the CodeBERT model. The input to the pre-trained backbone network model includes a token sequence and an attention mask, and the output is a context hidden vector corresponding to each token. In this embodiment, the hidden vector corresponding to the classification label is selected as the global code semantic feature of the source code fragment.

[0041] To preserve the general code syntax and semantic knowledge learned by the pre-trained model and reduce training complexity, this embodiment freezes the parameters of the embedding layer and some low-level coding layers in the pre-trained backbone network, and only trains the high-level coding parameters that are not frozen and the subsequent task adaptation modules.

[0042] S22: Input the semantic features of the code into the meta-adaptation layer, output the normalization layer and the linear classifier to obtain the vulnerability prediction probability of the current model.

[0043] The meta-adaptation layer includes at least one high-dimensional feature transformation structure. Preferably, each meta-adaptation layer sequentially includes a linear mapping layer, a normalization layer, a nonlinear activation function, and a random deactivation operation. The features processed by the meta-adaptation layer are further input to the output normalization layer to obtain a stable high-level code representation. Subsequently, the normalized features are input to a linear classifier to obtain the first... The vulnerability prediction logit for each source code sample is then mapped to the probability that the current model predicts the source code sample to be vulnerable using the Sigmoid function: (2) in, This represents the vulnerability prediction logit output by the linear classifier. This indicates that the current model predicts the [number]th [item]. The probability that a source code sample contains a vulnerability. This represents the Sigmoid function.

[0044] S3: Dynamically correct the initial soft labels in the training batch. Temporary task parameters are obtained through inner loop training, and label correction scores are generated through outer loop validation loss feedback. The dynamic label correction process employs a two-layer meta-learning optimization method. The inner loop constructs perturbed meta-target soft labels based on training batches and temporarily updates high-level task-related parameters. The outer loop applies temporary task parameters to the meta-validation set and applies gradient feedback to the label perturbation term of the training samples based on the meta-validation loss, thereby determining whether increasing the positive class tendency of unlabeled samples is beneficial to the generalization performance of the meta-validation set.

[0045] S31: Based on the sample labeling information, the initial soft labels of unlabeled samples are dynamically corrected to obtain the updated global soft labels; S32: Temporary task parameters are obtained through inner loop training; For each sample in the training batch, this embodiment first constructs a binary classification soft label vector based on the current global soft label. Then, a differentiable perturbation term with the same dimension as the binary classification label vector is introduced for each training sample, and a meta-target soft label is constructed using a normalization function, specifically expressed as follows: (3) in, Indicates the first Round Global soft labels for each sample. This represents a differentiable perturbation term with the same dimension as the binary classification soft label vector. This represents the normalization function. For samples in the labeled positive sample set P, their meta-target soft label is always fixed as the positive class label; for samples in the unlabeled sample set U, their meta-target soft label can be adjusted based on meta-validation feedback.

[0046] The first loss function is calculated based on the meta-target soft label and the vulnerability prediction probability output by the current model. This first loss function is the inner loop meta-training loss, denoted as... , is represented as: (4) in, This indicates the number of samples in the current training batch. This represents the binary classification probability vector output by the model for the i-th training sample. This represents the meta-target soft label of the i-th training sample. This represents the weighted binary cross-entropy loss function that supports soft labels.

[0047] In the inner loop, the semantic features of the code extracted by the pre-trained backbone network are kept as fixed inputs. The meta-adaptation layer, output normalization layer, and linear classifier constitute the set of high-level task-related parameters, denoted as . Based on the first loss function, a temporary update is performed on the parameters related to the high-level task to obtain the temporary task parameters: (5) in, This represents the high-level task-related parameters of the meta-adaptation layer, output normalization layer, and linear classifier. This indicates the task parameters after a temporary update. This represents the learning rate of the inner loop. This represents the training loss function for the inner loop element.

[0048] S33: Generate label correction scores through outer loop element validation loss feedback; Temporary task parameters Applied to an independent meta-validation set, a second loss function is calculated. This second loss function is the outer loop meta-validation loss, denoted as... , is represented as: (6) Where M represents the number of samples in the meta-validation batch. Indicates the use of temporary task parameters The obtained binary classification prediction probability vector of the j-th meta-validation sample. This represents the verification label of the j-th meta-verification sample. This represents the weighted binary cross-entropy loss function that supports soft labels.

[0049] Subsequently, the gradient of the second loss function with respect to the positive class dimension of the differentiable perturbation term in the training batch is calculated: (7) in, Indicates the first Each training sample corresponds to a differentiable perturbation term on the positive class dimension.

[0050] when At that time, it indicates the enhancement of the first The tendency of a training sample to have a positive class label helps reduce the meta-validation loss, therefore this sample is considered a potential positive sample candidate; when When this occurs, it indicates that enhancing the positive class label tendency is detrimental to the generalization of the meta-validation set, thus suppressing its positive class correction. This yields the initial label correction score based on meta-validation feedback: (8) in, Indicates the first The initial label correction score for each training sample is obtained based on the meta-validation feedback. For samples in the set of positively labeled samples P, their label correction score is fixed at 1.

[0051] It should be noted that the initial label correction score is not directly used as the final soft label, but rather as a candidate correction signal to participate in subsequent constraint processing.

[0052] In an alternative implementation, a prediction probability gating mechanism can also be introduced. If the current model's predicted probability of a vulnerability for an unlabeled sample is lower than a preset probability gating threshold, the label correction score for that sample is suppressed to reduce erroneous corrections caused by low-confidence samples.

[0053] S4: Based on vulnerability prototype constraints, positive rate constraints, and exponential moving average strategies, the label correction score is constrained and smoothly updated to obtain the updated global soft label. S41: Softly filter the label correction score based on vulnerability prototype constraints.

[0054] To avoid the over-boosting of soft labels for unlabeled samples due to reliance solely on meta-validation gradient feedback, this embodiment further introduces a vulnerability prototype constraint mechanism.

[0055] The steps for correcting constraints based on vulnerability prototypes are as follows: Construct vulnerability prototype vectors based on the code semantic features of known vulnerability samples; calculate the similarity between the code semantic features of unlabeled samples and the vulnerability prototype vectors; when the similarity meets a preset gating condition, assign a larger prototype weight to retain the label correction score of the corresponding unlabeled sample; when the similarity does not meet the preset gating condition, assign a smaller prototype weight to suppress the label correction score of the corresponding unlabeled sample.

[0056] Specifically, the vulnerability prototype vector is constructed or updated based on the code semantic features of the labeled positive sample set P, and the similarity between the code semantic features of unlabeled samples and the vulnerability prototype vector is calculated.

[0057] set up Indicates the first The semantic features of the code of each sample Let the vulnerability prototype vector be represented. Then, the similarity between the unlabeled sample and the vulnerability prototype is expressed as: (9) Based on the similarity, the corresponding prototype weights are generated: (10) in, This represents the Sigmoid function. This represents the prototype gated sharpening coefficient. This represents the similarity threshold. The similarity threshold can be a preset fixed threshold, or it can be adaptively determined based on the historical mean and standard deviation of the similarity of unlabeled samples.

[0058] Based on the prototype weights, a soft constraint is applied to the initial label correction score obtained from the meta-validation feedback to obtain the prototype-constrained label correction score: (11) in, This represents the initial label correction score obtained based on the meta-validation feedback. This represents the label correction score after the vulnerability prototype constraint.

[0059] When the similarity between an unlabeled sample and the vulnerability prototype vector is high, the prototype weight is large, thus preserving its label correction score; when the similarity is low, the prototype weight is small, thus softly suppressing its label correction score. After the vulnerability prototype constraint, the prototype-constrained label correction score is obtained.

[0060] S42: Employ a positive rate constraint mechanism to truncate the label correction score.

[0061] To prevent too many unlabeled samples from being promoted to potential positive samples, this embodiment employs a positive rate constraint mechanism to truncate the label correction scores after vulnerability prototype constraints. Specifically, the allowed proportion of positive sample capacity for the current training batch is determined based on the positive sample capacity multiplier and the positive class prior: (12) in, Represents the positive sample size multiplier. This represents the positive class prior, which can be the proportion of observed positive samples in the training set or a preset positive class prior. This indicates the proportion of positive samples allowed in the current training batch.

[0062] For unlabeled samples, calculate the positive increment of the label correction score after vulnerability prototype constraints relative to the current base soft label: (13) in, This represents the label correction score after being constrained by the vulnerability prototype. Indicates the first Round The current global soft label for each sample. This represents the corresponding positive correction increment.

[0063] Subsequently, the capacity budget is calculated based on the proportion of positive samples allowed in the current training batch, and then adjusted according to the positive correction increment. Unlabeled samples are sorted from largest to smallest. Within the remaining capacity budget, candidate samples with larger correction increments are retained first; for low-confidence samples exceeding the capacity budget, their correction increments are set to zero or truncated proportionally to the budget. This yields the label correction scores after capacity truncation. (14) in, This represents the correction increment retained after positive rate capacity truncation. This represents the label-corrected score after capacity truncation. For the set of labeled positive samples... For the samples in the dataset, the label correction score after truncation remains at 1.

[0064] S43: Update global soft tags based on the exponential moving average (EMA) strategy.

[0065] To avoid drastic fluctuations in soft labels during training, this embodiment employs an exponential moving average (EMA) strategy to smoothly fuse the truncated label correction scores with historical global soft labels. Let the... The historical soft tag retention factor of the wheel is The global soft tag update formula is: (15) in, Indicates the first Round Global soft labels for each sample. This represents the label correction score after being constrained by the vulnerability prototype and truncated with positive rate capacity. Indicates the first Historical soft tag retention coefficient of the wheel.

[0066] During the designated preheating phase, Setting a relatively large initial value allows the model to primarily retain historical soft labels, incorporating only a small amount of label correction information, thus improving training stability. Once training has passed the warm-up phase, as the number of iterations increases, The label correction score is gradually reduced according to a preset scheduling strategy, allowing the model to gradually enhance its utilization of the corrected label score. This smooth update mechanism can reduce the impact of pseudo-label oscillations on model training, enabling label quality and model feature extraction capabilities to evolve synergistically.

[0067] S5: Optimize the model parameters based on the updated global soft tags and the vulnerability prediction probabilities output by the current model, and obtain code vulnerability detection results based on the trained model.

[0068] S51: Calculate the main training loss.

[0069] After completing the dynamic correction of soft tags, the training batch is input into the feature extraction model to obtain the vulnerability prediction logit and corresponding vulnerability prediction probability output by the current model. A third loss function is calculated based on the updated global soft tags; this third loss function is the main training loss, denoted as... This is used to formally optimize the trainable parameters of the model. The main training loss is expressed as: (16) in, Indicates the number of samples in the training batch. Indicates the current model for the th The vulnerability prediction logit output of each sample. This indicates a globally modified soft tag. This represents the focus loss function that supports continuous soft labels.

[0070] Preferably, the main training loss employs a focus loss that supports continuous soft labels to reduce the impact of class imbalance on model training and to make the model pay more attention to hard-to-classify samples. It should be noted that the focus loss is used for model parameter optimization during the main training phase; in the meta-learning label correction phase, meta-training loss and meta-validation loss that support soft labels can be used for gradient feedback.

[0071] S52: Perform model parameter update.

[0072] After obtaining the main training loss, backpropagation is performed to calculate the gradient of the loss relative to the unfrozen parameters in the pre-trained backbone network, the meta-adaptive layer, the output normalization layer, and the trainable parameters in the linear classifier, and then the optimizer is used to perform parameter updates.

[0073] In one implementation, the AdamW optimizer is used for parameter optimization, and a weight decay mechanism is introduced to improve the model's generalization ability.

[0074] To prevent gradient explosion in deep neural networks trained on long-tailed imbalanced data, gradient pruning is performed on the gradients obtained from backpropagation before the optimizer steps, limiting the L2 norm of the gradients to within a preset threshold. Simultaneously, this embodiment employs a one-cycle learning rate scheduling strategy, gradually increasing the learning rate from a small value to a preset maximum learning rate in the early stages of training, and then gradually decreasing it during subsequent training, thereby improving the model's convergence stability.

[0075] S53: Vulnerability assessment is performed using fixed classification thresholds, specifically including: After training, the source code to be detected is input into the trained model to obtain the corresponding vulnerability prediction probability. This embodiment uses a fixed classification threshold of 0.5 as the boundary for vulnerability detection judgment. (17) when When the source code to be tested is deemed to have a vulnerability, it is determined that the source code to be tested contains a vulnerability. At that time, the source code to be tested is determined to be free of vulnerabilities.

[0076] S54: Output code vulnerability detection results.

[0077] The final classification result is obtained based on a fixed classification threshold of 0.5, and the vulnerability prediction probability and corresponding vulnerability detection result for each source code sample to be detected are output. The vulnerability detection result includes two categories: those with vulnerabilities and those without.

[0078] Example 2 This embodiment provides a code vulnerability detection system based on meta-learning and dynamic label correction, including: Positive Unlabeled Sample Construction Module: Obtains and preprocesses the source code dataset, constructs a positive sample set and an unlabeled sample set based on known vulnerabilities, and generates initial soft labels and sample labeling information for positive unlabeled learning; Code feature extraction module: Input the preprocessed source code data into the feature extraction model to obtain code semantic features and the vulnerability prediction probability of the current model; Training and Validation Module: Dynamically corrects the initial soft labels in the training batch, obtains temporary task parameters through inner loop training, and generates label correction scores through outer loop validation loss feedback; Soft tag constraint update module: Based on vulnerability prototype constraints, positive rate constraint mechanism and exponential moving average strategy, the tag correction score is constrained and smoothly updated to obtain the updated global soft tag. Vulnerability detection module: Optimizes model parameters based on the updated global soft tags and the vulnerability prediction probabilities obtained from the current model, and obtains code vulnerability detection results based on the trained model.

[0079] The descriptions of each embodiment in the above embodiments have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0080] The proposed system can be implemented in other ways. For example, the system embodiments described above are merely illustrative, and the division of modules described above is only a logical functional division. In actual implementation, there may be other division methods. For example, multiple modules may be combined or integrated into another system, or some features may be ignored or not executed.

[0081] Example 3 This embodiment also provides an electronic device, including: one or more processors, one or more memories, and one or more computer programs; wherein, the processor is connected to the memory, and the one or more computer programs are stored in the memory. When the electronic device is running, the processor executes the one or more computer programs stored in the memory to cause the electronic device to perform the method described in Embodiment 1.

[0082] It should be understood that in this embodiment, the processor can be a central processing unit (CPU), or it can be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor, etc.

[0083] Memory may include read-only memory and random access memory, and provides instructions and data to the processor. A portion of memory may also include non-volatile random access memory. For example, memory may also store information about the device type.

[0084] In the implementation process, each step of the above method can be completed by the integrated logic circuits in the processor hardware or by software instructions.

[0085] The method in Embodiment 1 can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor. The software modules can reside in readily available storage media in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory; the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method. To avoid repetition, a detailed description is not provided here.

[0086] Those skilled in the art will recognize that the units and algorithm steps described in connection with the various examples of this embodiment can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this invention.

[0087] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A code vulnerability detection method based on meta-learning and dynamic label correction, characterized in that, include: Obtain the source code dataset and preprocess it. Construct a positive sample set and an unlabeled sample set based on known vulnerabilities, and generate initial soft labels and sample labeling information for positive unlabeled learning. The preprocessed source code data is input into the feature extraction model to obtain the semantic features of the code and the vulnerability prediction probability of the current model. The initial soft labels in the training batch are dynamically corrected. Temporary task parameters are obtained through inner loop training, and label correction scores are generated through outer loop validation loss feedback. Specifically, this includes: The initial soft labels of unlabeled samples are dynamically corrected. The dynamic label correction process adopts an optimization method based on two-layer meta-learning to obtain updated global soft labels. Temporary task parameters are obtained based on inner loop gradient updates, including: introducing differentiable perturbation terms into the initial soft labels in the training batch to construct label perturbations; calculating the first loss function supporting the soft labels based on the meta-target soft labels and the vulnerability prediction probabilities obtained by the current model; and temporarily updating the model parameters of the meta-adaptation layer, output normalization layer, and classifier through gradient descent according to the first loss function to obtain temporary task parameters. The method for generating label correction scores based on the outer loop generalization error includes: applying temporary task parameters to the meta-validation set, calculating the outer loop meta-validation loss as the second loss function, and performing meta-validation loss feedback; calculating the gradient of the second loss function with respect to the differentiable perturbation term, and generating label correction scores according to the gradient descent direction. Based on vulnerability prototype constraints, positive rate constraints, and exponential moving average strategies, the label correction scores are constrained and smoothly updated to obtain updated global soft labels. This includes: using a positive rate constraint mechanism to truncate the capacity of the label correction scores after vulnerability prototype constraints; and using an exponential moving average strategy to smoothly merge the capacity-truncated label correction scores with historical global soft labels to obtain updated global soft labels. The model parameters are optimized based on the updated global soft tags and the vulnerability prediction probabilities output by the current model, and the code vulnerability detection results are obtained based on the trained model.

2. The code vulnerability detection method based on meta-learning and dynamic label correction according to claim 1, characterized in that, The preprocessed source code data is input into the feature extraction model to obtain the code feature sequence and the vulnerability prediction probability of the current model, including the following steps: The preprocessed source code data is input into the pre-trained backbone network to obtain the pooling features extracted by the pre-trained backbone network. Pooled features are input into the meta-adapter layer for high-dimensional feature transformation, and then connected to a linear classifier to obtain the vulnerability prediction probability of the current model.

3. The code vulnerability detection method based on meta-learning and dynamic label correction according to claim 1, characterized in that, The model parameters are optimized based on the updated global soft tags and the vulnerability prediction probabilities obtained from the current model, including: The third loss function is calculated by combining the updated global soft tags with the current vulnerability prediction probability. The gradient of the third loss function is calculated using the backpropagation algorithm, and an optimizer with weight decay and gradient pruning mechanisms is used to perform parameter updates, thus completing the global optimization of the model.

4. The code vulnerability detection method based on meta-learning and dynamic label correction according to claim 1, characterized in that, The code vulnerability detection results obtained based on the trained model include: Obtain the vulnerability prediction probability of the source code to be detected; use a fixed classification threshold to determine the vulnerability prediction probability. When the vulnerability prediction probability is greater than or equal to the fixed classification threshold, the source code to be detected is determined to have a vulnerability; when the vulnerability prediction probability is less than the fixed classification threshold, the source code to be detected is determined to have no vulnerability.

5. A code vulnerability detection system based on meta-learning and dynamic label correction, characterized in that, The code vulnerability detection method based on meta-learning and dynamic label correction as described in any one of claims 1-4 includes: Positive Unlabeled Sample Construction Module: Obtains and preprocesses the source code dataset, constructs a positive sample set and an unlabeled sample set based on known vulnerabilities, and generates initial soft labels and sample labeling information for positive unlabeled learning; Code feature extraction module: Input the preprocessed source code data into the feature extraction model to obtain code semantic features and the vulnerability prediction probability of the current model; Training and Validation Module: Dynamically corrects the initial soft labels in the training batch, obtains temporary task parameters through inner loop training, and generates label correction scores through outer loop validation loss feedback; Soft tag constraint update module: Based on vulnerability prototype constraints, positive rate constraint mechanism and exponential moving average strategy, the tag correction score is constrained and smoothly updated to obtain the updated global soft tag. Vulnerability detection module: Optimizes model parameters based on the updated global soft tags and the vulnerability prediction probabilities obtained from the current model, and obtains code vulnerability detection results based on the trained model.

6. An electronic device, characterized in that, include: Memory is used to store computer-readable instructions in a non-transitory manner. as well as Processor, for executing the computer-readable instructions, When the computer-readable instructions are executed by the processor, they perform the code vulnerability detection method based on meta-learning and dynamic label correction as described in any one of claims 1-4.

Images