一次训练，灵活融合多种漏洞检测模型，快速应对新漏洞。
You Only Train Once: A Flexible Training Framework for Code Vulnerability Detection Driven by Vul-Vector
- 通过参数融合整合多模型，无需联合训练。
- 支持新漏洞快速适配，更新效率大幅提升。
- 适合需要持续响应新漏洞的代码安全团队。
随着计算机应用在各行业的广泛应用，代码库中的漏洞带来重大风险。软件生态的多样性与现代软件工程的复杂性促使漏洞检测从人工转向自动化工具。深度学习方法因精度高而受到青睐，但其面临标注数据需求大、训练周期长的问题，且面对新漏洞频发，频繁重训成本高昂，限制了其在前沿场景的应用。为此，本文提出YOTO（You Only Train Once）框架，通过参数融合实现多种漏洞检测模型的集成，避免联合训练。该框架可快速适应新发现的漏洞，显著降低模型更新的时间与计算资源开销。
原文摘要 · Abstract (English)
With the pervasive integration of computer applications across industries, the presence of vulnerabilities within code bases poses significant risks. The diversity of software ecosystems coupled with the intricate nature of modern software engineering has led to a shift from manual code vulnerability identification towards the adoption of automated tools. Among these, deep learning-based approaches have risen to prominence due to their superior accuracy; however, these methodologies encounter several obstacles. Primarily, they necessitate extensive labeled datasets and prolonged training periods, and given the rapid emergence of new vulnerabilities, the frequent retraining of models becomes a resource-intensive endeavor, thereby limiting their applicability in cutting-edge scenarios. To mitigate these challenges, this paper introduces the \underline{\textbf{YOTO}}--\underline{\textbf{Y}}ou \underline{\textbf{O}}nly \underline{\textbf{T}}rain \underline{\textbf{O}}nce framework. This innovative approach facilitates the integration of multiple types of vulnerability detection models via parameter fusion, eliminating the need for joint training. Consequently, YOTO enables swift adaptation to newly discovered vulnerabilities, significantly reducing both the time and computational resources required for model updates.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。