检索结果-内蒙古大学图书馆

Vul-LMGNNs: Fusing language models and online-distilled graph neural networks for code vulnerability detection

INFORMATION FUSION 2025年 115卷

作者： Liu, Ruitong Wang, Yanbin Xu, Haitao Sun, Jianguo Zhang, Fan Li, Peiyue Guo, Zhenhao Shenzhen MSU BIT Univ Shenzhen 518172 Peoples R China Xidian Univ Hangzhou Res Inst Technol Hangzhou 311200 Peoples R China Zhejiang Univ Coll Comp Sci & Technol Sch Cyber Sci & Technol Hangzhou 310027 Peoples R China Peoples Publ Secur Univ China Beijing 100038 Peoples R China

code Language Models (codeLMs) and Graph Neural Networks (GNNs) are widely used in code vulnerability detection. However, a critical yet often overlooked issue is that GNNs primarily rely on aggregating information from adjacent nodes, limiting structural information transfer to single-layer updates. In code graphs, nodes and relationships typically require cross-layer information propagation to fully capture complex program logic and potential vulnerability patterns. Furthermore, while some studies utilize codeLMs to supplement GNNs with code semantic information, existing integration methods have not fully explored the potential of their collaborative effects. To address these challenges, we introduce Vul-LMGNNs that integrates pre-trained codeLMs with GNNs, leveraging knowledge distillation to facilitate cross-layer propagation of both code semantic knowledge and structural information. Specifically, Vul-LMGNNs utilizes code Property Graphs (CPGs) to incorporate code syntax, control flow, and data dependencies, while employing gated GNNs to extract structural information in the CPG. To achieve cross-layer information transmission, we implement an online knowledge distillation (KD) program that enables a single student GNN to acquire structural information extracted from a simultaneously trained counterpart through an alternating training procedure. Additionally, we leverage pre-trained codeLMs to extract semantic features from code sequences. Finally, we propose an "implicit-explicit" joint training framework to better leverage the strengths of both codeLMs and GNNs. In the implicit phase, we utilize codeLMs to initialize the node embeddings of each student GNN. Through online knowledge distillation, we facilitate the propagation of both code semantics and structural information across layers. In the explicit phase, we perform linear interpolation between the codeLM and the distilled GNN to learn a late fusion model. The proposed method, evaluated across four rea

关键词： code vulnerability detection Graph information fusion Pre-trained code model Joint training

来源：评论

学校读者我要写书评

暂无评论

Manual Prompt Engineering is Not Dead: A Case Study on Large Language Models for code vulnerability detection with DSPy 8

Manual Prompt Engineering is Not Dead: A Case Study on Large...

引用

8th International Conference on Data Science and Machine Learning Applications, CDMA 2025

作者： Trad, Fouad Chehab, Ali Electrical and Computer Engineering American University of Beirut Beirut Lebanon

ISBN: (纸本)9798331539696

Automated prompt engineering tools have recently emerged as a promising solution to simplify the traditional man-ual task of crafting prompts for large language models (LLMs). This study investigates whether such tools can fully replace manual prompt engineering for code vulnerability detection. We leverage the DSPy (Declarative Self-improving Python) frame-work, which uses modular 'signatures' rather than prompts to specify tasks. In DSPy, a signature defines the expected input-output behavior of a task and can optionally include a description to guide the model's objective. This signature is then auto-matically translated into an optimized prompt through DSPy's modules and optimizers. This study compares the performance of GPT-4o-mini on basic and detailed signatures to determine how DSPy optimizations affect model performance in each case. The basic signature prompts the model to classify code as vulnerable or not, while the detailed signature specifies particular vulnerabilities to identify. For each signature, we used DSPy's modules and optimizers to create three prompt configurations: zero-shot (baseline, where the model performs the task without examples), chain-of-thought (where the model shows step-by-step reasoning), and bootstrap few-shot (where the model is guided through a small set of examples). Results show that DSPy's automated optimizations improve performance for both signature types over the zero-shot baseline;however, detection performance increases significantly with detailed signatures. Specifically, the detailed signatures achieved higher F1 scores, with improvements of approximately 23 % for zero-shot, 13 % for chain-of-thought, and 11 % for bootstrap few-shot techniques. These findings indicate that while automated tools enhance prompt efficiency, optimal results are achieved by combining automated techniques with human-crafted signature details, underscoring the ongoing importance of manual refinement in specialized tasks. © 2025 IEEE.

关键词： code vulnerability detection DSPy Large Language Models Prompt engineering

来源：评论

学校读者我要写书评

暂无评论

Combining Graph-Based Learning With Automated Data Collection for code vulnerability detection

引用

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY 2021年 16卷 1943-1958页

作者： Wang, Huanting Ye, Guixin Tang, Zhanyong Tan, Shin Hwei Huang, Songfang Fang, Dingyi Feng, Yansong Bian, Lizhong Wang, Zheng Northwest Univ Sch Informat Sci & Technol Xian 710127 Peoples R China Southern Univ Sci & Technol Dept Comp Sci & Engn Shenzhen 518055 Peoples R China Alibaba DAMO Acad Hangzhou 311121 Peoples R China Peking Univ Wangxuan Inst Comp Technol WICT Beijing 100871 Peoples R China Hangzhou Informat & Technol Co Ltd Hangzhou 310099 Peoples R China Univ Leeds Sch Comp Leeds LS2 9JT W Yorkshire England

This paper presents FUNDED (Flow-sensitive vUl-Nerability code detection), a novel learning framework for building vulnerability detection models. Funded leverages the advances in graph neural networks (GNNs) to develop a novel graph-based learning method to capture and reason about the program's control, data, and call dependencies. Unlike prior work that treats the program as a sequential sequence or an untyped graph, Funded learns and operates on a graph representation of the program source code, in which individual statements are connected to other statements through relational edges. By capturing the program syntax, semantics and flows, Funded finds better code representation for the downstream software vulnerability detection task. To provide sufficient training data to build an effective deep learning model, we combine probabilistic learning and statistical assessments to automatically gather high-quality training samples from open-source projects. This provides many real-life vulnerable code training samples to complement the limited vulnerable code samples available in standard vulnerability databases. We apply Funded to identify software vulnerabilities at the function level from program source code. We evaluate Funded on large real-world datasets with programs written in C, Java, Swift and Php, and compare it against six state-of-the-art code vulnerability detection models. Experimental results show that Funded significantly outperforms alternative approaches across evaluation settings.

关键词： Software vulnerability code vulnerability detection deep learning deep graph neural networks

来源：评论

学校读者我要写书评

暂无评论

VulGraB: Graph-embedding-based code vulnerability detection with bi-directional gated graph neural network

引用

SOFTWARE-PRACTICE & EXPERIENCE 2023年第8期53卷 1631-1658页

作者： Wang, Sixuan Huang, Chen Yu, Dongjin Chen, Xin Hangzhou Dianzi Univ Sch Comp Sci & Technol Hangzhou 310018 Peoples R China

code vulnerabilities can have serious consequences such as system attacks and data leakage, making it crucial to perform code vulnerability detection during the software development phase. Deep learning is an emerging approach for vulnerability detection tasks. Existing deep learning-based code vulnerability detection methods are usually based on word2vec embedding of linear sequences of source code, followed by code vulnerability detection through RNNs network. However, such methods can only capture the superficial structural or syntactic information of the source code text, which is not suitable for modeling the complex control flow and data flow and miss edge information in the graph structure constructed by the source code, with limited effect of neural network model. To solve the above problems, this article proposes a code vulnerability detection method, named VulGraB, which is based on graph embedding and bidirectional gated graph neural networks. VulGraB uses node2vec to convert the program-dependent graphs into graph embeddings of the code, which contain rich structure information of the source code, improving the ability of features to express nonlinear information to a certain extent. Then the BiGGNN is used for training, and finally the accuracy of the detection results is evaluated using target program. The bi-directional gated neural network utilizes a bi-directional recurrent structure, which is beneficial to global information aggregation. The experimental results show that the accuracy of VulGraB is significantly improved over the baseline models on two datasets, with F1 scores of 85.89% and 97.24% being the highest, demonstrating that VulGraB consistently outperforms other effective vulnerability detection models.

关键词： bi-directional gated neural network code vulnerability detection deep learning graph embedding node2vec

来源：评论

学校读者我要写书评

暂无评论

On the code vulnerability detection Based on Deep Learning: A Comparative Study

引用

IEEE ACCESS 2024年 12卷 152377-152391页

作者： Li, Guiping Yang, Yege Xian Technol Univ Sch Comp Sci & Engn Xian 710021 Peoples R China

Deep learning is one of the important methods to detect and fix vulnerabilities in software programs. How to represent code information and how to use artificial intelligence methods to learn and understand code semantics and other information are crucial points in this method. vulnerability mining analysis based on source code is usually combined with compiler-related techniques to abstract program representations through lexical, syntactic, and semantic analyses, and further combined with data flow analysis, control flow analysis, static symbolic execution, and other techniques to verify the existence of vulnerabilities and identify the location of code defects. To compare the abilities of vulnerability detection methods, we first categorize vulnerability detection methods into two main types based on different intermediate representations: sequence-based and graph-based methods. And then, we further divide sequence-based methods into four categories and distinguish graph-based methods based on whether they employ slicing techniques. Following, through the analysis of specific examples, we compare the advantages and disadvantages of these two methods, and explore the differences and similarities in the neural networks they use. Lastly, we conduct a comparative analysis of the datasets used in the mentioned methods, highlight some challenges in this field, and present our thoughts on potential research directions.

关键词： codes Semantics Source coding Deep learning Feature extraction Analytical models Syntactics Static analysis Long short term memory Computer security Software reliability Software quality Software security deep learning program analysis automated static analysis code vulnerability detection vulnerability mining

来源：评论

学校读者我要写书评

暂无评论

SQVDT: A scalable quantitative vulnerability detection technique for source code security assessment

引用

SOFTWARE-PRACTICE & EXPERIENCE 2021年第2期51卷 294-318页

作者： Akram, Junaid Luo, Ping Tsinghua Univ Sch Software Key Lab Informat Syst Secur Beijing Peoples R China

vulnerability detection and exploit is becoming a very important part of security, especially in malware code delivery, hacking a system, efforts to create patches, improving the source code, or updating a software. Vulnerabilities in applications, including browsers, media players, online services, document readers, and so forth. are often exploited and cause a serious damage. In this article, we propose a vulnerability detection technique to detect vulnerabilities in software, as well as shared libraries at source code level. We crawl the vulnerable source code by tracing and locating the patch files from different web sources according to their CVE-numbers and built a fingerprint index of 2931 vulnerable files. Then we developed a vulnerability detection approach based on code clone detection technique and detect hundreds of vulnerabilities in thousands of GitHub open source projects, which are not noticed before as vulnerable. We detected vulnerabilities in some very famous recently available software, including latest version of Linux, HTC-kernel, FindX-8.1-kernel, and in 7-TB of C/C++ source code (152,823 open source projects). In this study, we discuss some of the very high severity level (CVSS) vulnerabilities that are detected by our approach. Furthermore, we performed an empirical evaluation and verification on these vulnerabilities, including intraproject clone vulnerabilities, copied-kernel clone vulnerabilities, and library-used clone vulnerabilities. Our technique is very fast, efficient, reliable, practical, scalable, and can be implemented at industrial level. The comparison with the state-of-the-art tools shows the effectiveness of our approach.

关键词： big code clone detection code vulnerability detection software reuse software security and maintenance

来源：评论

学校读者我要写书评

暂无评论

Question-Answer Methodology for Vulnerable Source code Review via Prototype-Based Model-Agnostic Meta-Learning

引用

FUTURE INTERNET 2025年第1期17卷 33-33页

作者： Corona-Fraga, Pablo Hernandez-Suarez, Aldo Sanchez-Perez, Gabriel Toscano-Medina, Linda Karina Perez-Meana, Hector Portillo-Portillo, Jose Olivares-Mercado, Jesus Villalba, Luis Javier Garcia Ctr Invest Innovac Tecnol Informac & Comunicac Ave San Fernando 37 Mexico City 14050 Mexico Inst Politecn Nacl ESIME Culhuacan Mexico City 04440 Mexico Univ Complutense Madrid UCM Fac Comp Sci & Engn Dept Software Engn & Artificial Intelligence DISIA Off 431Grp Anal Secur & Syst GASS Calle Prof Jose Garcia Santesmases 9Ciudad Univ Madrid 28040 Spain

In cybersecurity, identifying and addressing vulnerabilities in source code is essential for maintaining secure IT environments. Traditional static and dynamic analysis techniques, although widely used, often exhibit high false-positive rates, elevated costs, and limited interpretability. Machine Learning (ML)-based approaches aim to overcome these limitations but encounter challenges related to scalability and adaptability due to their reliance on large labeled datasets and their limited alignment with the requirements of secure development teams. These factors hinder their ability to adapt to rapidly evolving software environments. This study proposes an approach that integrates Prototype-Based Model-Agnostic Meta-Learning(Proto-MAML) with a Question-Answer (QA) framework that leverages the Bidirectional Encoder Representations from Transformers (BERT) model. By employing Few-Shot Learning (FSL), Proto-MAML identifies and mitigates vulnerabilities with minimal data requirements, aligning with the principles of the Secure Development Lifecycle (SDLC) and Development, Security, and Operations (DevSecOps). The QA framework allows developers to query vulnerabilities and receive precise, actionable insights, enhancing its applicability in dynamic environments that require frequent updates and real-time analysis. The model outputs are interpretable, promoting greater transparency in code review processes and enabling efficient resolution of emerging vulnerabilities. Proto-MAML demonstrates strong performance across multiple programming languages, achieving an average precision of 98.49%, recall of 98.54%, F1-score of 98.78%, and exact match rate of 98.78% in PHP, Java, C, and C++.

关键词： question-answer methodology vulnerable source code review prototype-based learning model-agnostic meta-learning Proto-MAML code vulnerability detection software security few-shot learning source code analysis meta-learning techniques automated code review cybersecurity knowledge transfer code reconstruction

来源：评论

学校读者我要写书评

暂无评论

Explainability-based Debugging of Machine Learning for vulnerability Discovery 22

Explainability-based Debugging of Machine Learning for Vulne...

引用

17th International Conference on Availability, Reliability and Security (ARES)

作者： Sotgiu, Angelo Pintor, Maura Biggio, Battista Pluribus One Cagliari Italy Univ Cagliari Cagliari Italy

ISBN: (纸本)9781450396707

Machine learning has been successfully used for increasingly complex and critical tasks, achieving high performance and efficiency that would not be possible for human operators. Unfortunately, recent studies have shown that, despite its power, this technology tends to learn spurious correlations from data, making it weak and susceptible to manipulation. Explainability techniques are often used to identify the most relevant features contributing to the decision. However, this is often done by taking examples one by one and trying to show the problem locally. To mitigate this issue, we propose in this paper a systematic method to leverage explainability techniques and build on their results to highlight problems in the model design and training. With an empirical analysis on the Devign dataset, we validate the proposed methodology with a codeBERT model trained for vulnerability discovery, showing that, despite its impressive performances, spurious correlations consistently steer its decision.

关键词： datasets neural networks code vulnerability detection machine learning

来源：评论

学校读者我要写书评

暂无评论

Detecting code vulnerabilities by learning from large-scale open source repositories

引用

JOURNAL OF INFORMATION SECURITY AND APPLICATIONS 2022年 69卷

作者： Xu, Rongze Tang, Zhanyong Ye, Guixin Wang, Huanting Ke, Xin Fang, Dingyi Wang, Zheng Northwest Univ Xian Peoples R China Univ Leeds Leeds England

Machine learning methods are widely used to identify common, repeatedly occurring bugs and code vulnerabilities. The performance of a machine-learned model is bounded by the quality and quantity of training data and the model's capability in extracting and capturing the essential information of the problem domain. Unfortunately, there is a storage of high-quality samples for training code vulnerability detection models, and existing machine learning methods are inadequate in capturing code vulnerability *** present DEVELOPER,(1 )a novel learning framework for building code vulnerability detection models. To address the data scarcity challenge, DEVELOPER automatically gathers training samples from open-source projects and applies constraints rules to the collected data to filter out noisy data to improve the quality of the collected samples. The collected data provides many real-world vulnerable code training samples to complement the samples available in standard vulnerable databases. To build an effective code vulnerability detection model, DEVELOPER employs a convolutional neural network architecture with attention mechanisms to extract code representation from the program abstract syntax tree. The extracted program representation is then fed to a downstream network - a bidirectional long-short term memory architecture - to predict if the target code contains a vulnerability or not. We apply DEVELOPER to identify vulnerabilities at the program source-code level. Our evaluation shows that DEVELOPER outperforms state-of-the-art methods by uncovering more vulnerabilities with a lower false-positive rate.

关键词： code vulnerability detection Deep learning Attention mechanism Software vulnerability

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：