融合代码风格与语法结构，提升漏洞检测准确率。
VulStyle: A Multi-Modal Pre-Training for Code Stylometry-Augmented Vulnerability Detection
- 仅保留非终端语法树节点，降低复杂度并保留语义层次。
- 在5个数据集上表现领先，部分任务F1提升48%。
- 适合关注代码风格与漏洞检测结合的研究者。
我们提出VulStyle，一种多模态软件漏洞检测模型，联合编码函数级源代码、非终端抽象语法树（AST）结构以及代码风格（CStyle）特征。现有工作主要依赖词元级模型或完整AST树，常忽略反映高风险编程习惯的风格线索，或带来高结构开销。本方法仅选取非终端AST节点，降低输入复杂度的同时保持语义层级，并将语法与词汇级CStyle特征作为辅助漏洞信号。VulStyle在跨7种编程语言的490万函数上进行掩码语言建模预训练，并在Devign、BigVul、DiverseVul、REVEAL和VulDeePecker五个基准数据集上微调。在BigVul和VulDeePecker上达到当前最优性能，相较于强基线模型F1提升4%-48%，在所有基准中均取得竞争性或最佳平均表现。我们还进行了消融实验以分离CStyle与AST结构的影响，开展错误案例分析，并构建攻击者真实场景下的威胁模型。
原文摘要 · Abstract (English)
We present VulStyle, a multi-modal software vulnerability detection model that jointly encodes function-level source code, non-terminal Abstract Syntax Tree (AST) structure, and code stylometry (CStyle) features. Prior work in code representation primarily leverages token-level models or full AST trees, often missing stylistic cues indicative of risky programming practices, or incurring high structural overhead. Our approach selects only non-terminal AST nodes, reducing input complexity while preserving semantic hierarchy, and integrates syntactic and lexical CStyle features as auxiliary vulnerability signals. VulStyle is pre-trained using masked language modeling on 4.9M functions across seven programming languages, and fine-tuned across five benchmark datasets: Devign, BigVul, DiverseVul, REVEAL, and VulDeePecker. VulStyle achieves state-of-the-art performance on BigVul and VulDeePecker, improving F1 by 4-48% over strong transformer baselines, and attains competitive or best-average performance across all benchmarks. We contribute an ablation study isolating the effect of CStyle and AST structure, error case analysis, and a threat model situating the detection task in attacker-realistic scenarios.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。