用混合模型结合程序结构与语义，提升漏洞检测准确率
Bridging Semantics & Structure for Software Vulnerability Detection using Hybrid Network Models
- 将程序视为异构图，融合控制流与数据流关系
- 在Java漏洞检测中达93.57%准确率，较GAT提升8.36%
- 生成可解释的子图和自然语言说明，适合开发者使用
软件漏洞仍是持续风险，传统静态与动态分析常忽略影响不安全行为的结构依赖。本文将程序建模为异构图，捕捉控制流与数据流关系构成的复杂交互网络。提出混合框架，结合图表示与轻量级（<4B）本地大模型，融合拓扑特征与语义推理，避免大型云端模型的成本与隐私问题。在Java漏洞检测（二分类）任务上，方法达到93.57%准确率，较基于图注意力网络的嵌入提升8.36%，较Qwen2.5 Coder 3B等预训练大模型高出17.81%。此外，该方法可提取显著子图并生成自然语言解释，增强开发者的可解释性。结果表明，该方案具备可扩展性、可解释性与本地部署能力，推动漏洞分析从语法检查迈向深层结构与语义洞察，促进其在真实软件开发中的广泛应用。
原文摘要 · Abstract (English)
Software vulnerabilities remain a persistent risk, yet static and dynamic analyses often overlook structural dependencies that shape insecure behaviors. Viewing programs as heterogeneous graphs, we capture control- and data-flow relations as complex interaction networks. Our hybrid framework combines these graph representations with light-weight (<4B) local LLMs, uniting topological features with semantic reasoning while avoiding the cost and privacy concerns of large cloud models. Evaluated on Java vulnerability detection (binary classification), our method achieves 93.57% accuracy-an 8.36% gain over Graph Attention Network-based embeddings and 17.81% over pretrained LLM baselines such as Qwen2.5 Coder 3B. Beyond accuracy, the approach extracts salient subgraphs and generates natural language explanations, improving interpretability for developers. These results pave the way for scalable, explainable, and locally deployable tools that can shift vulnerability analysis from purely syntactic checks to deeper structural and semantic insights, facilitating broader adoption in real-world secure software development.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。