基于大模型的多模态特征融合漏洞检测方法

doi:10.12379/j.issn.2096-1057.2026.11.02

摘要/Abstract

摘要： 随着开源软件的广泛应用，漏洞数量急剧增加，传统检测方法存在误报率高、难以捕捉复杂依赖关系等问题。为此，本文提出一种基于大模型的多模态特征融合漏洞检测方法（Multi-modal Feature Fusion Code Vulnerability Detection，MMFVD）。该方法首先构建多功能代码属性图（Multifunctional Code Property Graph，M-CPG），通过程序切片与剪枝保留关键结构信息；其次，利用预训练序列模型和图模型分别提取代码语义特征与结构特征，并通过在线知识蒸馏优化表征；最后，采用动态注意力机制实现特征的自适应融合，并通过分类器完成漏洞检测。在四个公开数据集上，对MMFVD与10种基线方法进行对比实验，验证了MMFVD在检测精度、鲁棒性和泛化能力方面的显著优势。

关键词: 漏洞检测；大模型；多模态特征融合；代码属性图

Abstract: With the widespread adoption of open-source software, the number of vulnerabilities has increased sharply. The traditional detection methods suffer from high false positive rates and difficulty in capturing complex dependencies. To address these issues, this paper proposes a large model-based multi-modal feature fusion vulnerability detection method named MMFVD. The method first constructs a Multi-functional Code Property Graph (M-CPG), which retains key structural information through program slicing and pruning. Next, pre-trained sequence models and graph models are used to extract semantic features and structural features of the code respectively, with online knowledge distillation applied to optimize feature representation. Finally, a dynamic attention mechanism is adopted to achieve adaptive fusion of the features, and a classifier is employed to complete vulnerability prediction. On four public datasets, MMFVD is compared with 10 baseline methods, which verifies the significant advantages of MMFVD in detection accuracy, robustness, and generalization.

Key words: vulnerability detection; large models; multimodal feature fusion; code property graph

中图分类号:

TP393

赵新建，陶驰宇，陈石，况博裕，吴子成，付安民. 基于大模型的多模态特征融合漏洞检测方法[J]. 信息安全研究, 2026, 12(11): 984-992.

Zhao Xinjian, Tao Chiyu, Chen Shi, Kuang Boyu, Wu Zicheng, Fu Anmin. A Multimodal Feature Fusion Approach for Vulnerability Detection Based on Large Models[J]. Journal of Information Security Reserach, 2026, 12(11): 984-992.

参考文献

[1] 贾培养，孙鸿宇，曹婉莹，等. 开源软件漏洞库综述[J]. 信息安全研究，2021，7（6）：566-574. [2] 李永刚，杨宇波，潘善民. 基于大模型驱动的自动化漏洞挖掘系统研究[J]. 信息安全研究，2025，11（E2）：154-159. [3] 苏小红，郑伟宁，蒋远，等. 基于学习的源代码漏洞检测研究与进展[J]. 计算机学报，2024，47（2）：337-374. [4] 陈子雄，陈旭，景永俊，等. 基于图神经网络的源代码漏洞检测研究综述[J]. 计算机工程与科学，2024，46（10）：1775-1792. [5] Han D, Qi P, Zhang J, et al. Mkdd-Vul: A Lightweight Multi-Modal Knowledge Distillation Framework for Detecting Vulnerabilities in Smart Contracts[J]. Expert Systems with Applications, 2026, 303: 130619. [6] Cao x, Wang j, Wu p, et al. Vulmpff: A Vulnerability Detection Method for Fusing Code Features in Multiple Perspectives[J]. IET Information Security, 2024, 2024(1):4313185. [7] Zou d, Wang s, Xu s, et al. Μvuldeepecker: A Deep Learning-Based System for Multiclass Vulnerability Detection[J]. IEEE Transactions On Dependable and Secure Computing, 2021, 18(5): 2224-2236. [8] Li z, Zou d, Xu s, et al. Sysevr: A Framework for Using Deep Learning to Detect Software Vulnerabilities[J]. IEEE Transactions on Dependable and Secure Computing, 2022, 19(4): 2244-2258. [9] Kim s, Choi j, Ahmed m e, et al. Vuldebert: A Vulnerability Detection System Using Bert[C]//2022 IEEE International Symposium on Software Reliability Engineering Workshops. Piscataway, NJ: IEEE, 2022: 69-74. [10]罗一帆，姜思羽，陈伟利，等. 基于人工智能的智能合约漏洞检测研究综述[J]. 网络空间安全科学学报，2025，3（3）：25-37. [11] Zhou y, Liu s, Siow j k, et al. Devign: Effective Vulnerability Identification by Learning Comprehensive Program Semantics via Graph Neural Networks[C]//Advances in Neural Information Processing Systems 32. Red Hook, NY: Curran Associates,2019:10197-10207. [12] Rabheru r, Hanif h, Maffeis s. A Hybrid Graph Neural Network Approach for Detecting Php Vulnerabilities[C]//2022 IEEE Conference on Dependable and Secure Computing. Piscataway, NJ: IEEE,2022:1-9. [13] Zhong q, Peng t, Chen s x. Vuldecrg: A Vulnerability Detection System Based on Code Representation Graph[C]//2023 2nd International Conference on Artificial Intelligence, Human-Computer Interaction and Robotics. Piscataway, NJ: IEEE,2023:243-247. [14] Li y, Wang s, Nguyen t n. Vulnerability Detection with Fine-Grained Interpretations[C]//Proceedings of the 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering. New York: ACM,2021:292-303. [15] 王海波，王其文，郭燕，等. 面向攻防对抗的自动化漏洞利用研究综述[J]. 网络空间安全科学学报，2025，3（3）：38-56. [16] 董凌众，张倬胜，孟魁，等. 基于图增强的大模型生成中文文本黑盒检测[J]. 网络空间安全科学学报，2025，3（3）：68-78. [17] Liu r, Wang y, Xu h, et al. Vul-Lmgnns: Fusing Language Models and Online-Distilled Graph Neural Networks for Code Vulnerability Detection[J]. Information Fusion, 2025, 115: 102748. [18] Feng z, Guo d, Tang d, et al. Codebert: A Pre-Trained Model for Programming and Natural Languages[C]//Findings of the Association for Computational Linguistics: EMNLP 2020. Online: Association for Computational Linguistics,2020:1536-1547. [19] Zhang j, Zhang h, Xia c, et al. Graph-Bert: Only Attention Is Needed for Learning Graph Representations[EB/OL]. 2020[2026-08-05]. https://arxiv.org/abs/2001.05140. [20] Chen y, Ding z, Alowain l, et al. Diversevul: A New Vulnerable Source Code Dataset for Deep Learning-Based Vulnerability Detection[C]//Proceedings of the 26th International Symposium on Research in Attacks, Intrusions and Defenses. New York: ACM,2023:654-668. [21] Russell r l, Kim l, Hamilton l, et al. Automated Vulnerability Detection in Source Code Using Deep Representation Learning[C]//2018 17th IEEE International Conference on Machine Learning and Applications. Piscataway, NJ: IEEE,2018:757-762. [22] Fan j, Li y, Wang s, et al. A c/c++ Code Vulnerability Dataset with Code Changes And Cve Summaries[C]//Proceedings of the 17th International Conference on Mining Software Repositories. New York: ACM, 2020:508-512. [23] Lu s, Guo d, Ren s, et al. Codexglue: A Machine Learning Benchmark Dataset for Code Understanding and Generation[C]//Proceedings of the Neural Information Processing Systems Track on Datasets and Benchmarks. Online: NeurIPS, 2021:1-14. [24] Devlin j, Chang m w, Lee k, et al. Bert: Pre-Training of Deep Bidirectional Transformers for Language Understanding[C]//Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies. Minneapolis: Association for Computational Linguistics, 2019: 4171- 4186. [25] Guo d, Ren s, Lu s, et al. Graphcodebert: Pre-Training Code Representations with Data Flow[C]//Proceedings of the 9th International Conference on Learning Representations. Online: OpenReview.net, 2021: 1-15. [26] Wang y, Wang w, Joty s, et al. Codet5: Identifier-Aware Unified Pre-Trained Encoder-Decoder Models for Code Understanding and Generation[C]//Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing. Punta Cana: Association for Computational Linguistics,2021:8696-8708. [27] KIM Y. Convolutional Neural Networks for Sentence Classification[C]//Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing. Doha: Association for Computational Linguistics, 2014: 1746-1751. [28] Yao l, Mao c, Luo y. Graph Convolutional Networks for Text Classification[C]//Proceedings of the AAAI Conference on Artificial Intelligence. Palo Alto, CA: AAAI Press, 2019: 370-7377.