arXiv:2510.04397cs.CRcs.AI2025-10被引 2

多语言漏洞检测新模型,同时学共性与语言特性。

MulVuln: Enhancing Pre-trained LMs with Shared and Language-Specific Knowledge for Multilingual Vulnerability Detection

  • 融合跨语言共性与语言特异性知识进行检测
  • 在7种语言上提升F1分数1.45%至23.59%
  • 适合需要多语言代码安全分析的开发者

软件漏洞对安全关键系统构成严重威胁,推动了基于AI的漏洞检测方法发展。尽管已有成果显著,但多数方法仅限于单一编程语言,难以应对现代多语言混合的复杂软件。现有方法往往无法同时捕捉代码的通用特征和语言特有规范,限制了其在多样化语言和真实代码库中的表现。为此,我们提出MULVULN,一种新型多语言漏洞检测方法,能从多种编程语言中学习源码知识。该方法同时建模跨语言共享知识与语言特定知识,实现对真实多语言软件系统的更鲁棒、高效漏洞检测。在包含4,466个CVE及30,987个补丁的多样化的REEF数据集上,经过严格实验验证,MULVULN优于十三种先进基线方法,F1分数提升达1.45%至23.59%。

原文摘要 · Abstract (English)

Software vulnerabilities (SVs) pose a critical threat to safety-critical systems, driving the adoption of AI-based approaches such as machine learning and deep learning for software vulnerability detection. Despite promising results, most existing methods are limited to a single programming language. This is problematic given the multilingual nature of modern software, which is often complex and written in multiple languages. Current approaches often face challenges in capturing both shared and language-specific knowledge of source code, which can limit their performance on diverse programming languages and real-world codebases. To address this gap, we propose MULVULN, a novel multilingual vulnerability detection approach that learns from source code across multiple languages. MULVULN captures both the shared knowledge that generalizes across languages and the language-specific knowledge that reflects unique coding conventions. By integrating these aspects, it achieves more robust and effective detection of vulnerabilities in real-world multilingual software systems. The rigorous and extensive experiments on the real-world and diverse REEF dataset, consisting of 4,466 CVEs with 30,987 patches across seven programming languages, demonstrate the superiority of MULVULN over thirteen effective and state-of-the-art baselines. Notably, MULVULN achieves substantially higher F1-score, with improvements ranging from 1.45% to 23.59% compared to the baseline methods.

漏洞检测多语言预训练模型代码安全

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。