Search papers, labs, and topics across Lattice.
This paper introduces FusionVul, a novel multimodal feature fusion framework designed to enhance source code vulnerability detection by combining syntactic representations from a pretrained Transformer with structural semantics from a graph neural network. The approach addresses the limitations of traditional static-analysis methods and single-modality models, which often fail to capture critical execution dependencies and structural information. Experimental evaluations reveal that FusionVul significantly outperforms existing methods on diverse datasets, achieving superior F1 scores and demonstrating its effectiveness in identifying complex vulnerability patterns across varying function sizes and types.
FusionVul outperforms traditional methods by integrating syntactic and structural insights, achieving unprecedented accuracy in detecting complex code vulnerabilities.
Source code vulnerability detection remains a long-standing challenge due to the increasing scale, structural complexity, and semantic diversity of modern codebases. Conventional static-analysis or rule-based approaches often fail to capture subtle execution dependencies, while single-modality learning models tend to overlook critical structural information embedded beyond the lexical surface of source code. To improve robustness across heterogeneous code patterns, we propose FusionVul, a joint representation learning framework that integrates sequential syntactic representations extracted by a pretrained Transformer encoder with structural semantics propagated through a graph neural network. The framework further incorporates a cross-attention-based feature fusion network to enable fine-grained cross-modal interaction and employs a sample-aware weighting mechanism to integrate multiple predictive branches. Experimental results on four datasets demonstrate that FusionVul achieves superior F1 scores on datasets with highly dispersed function size distributions and broader vulnerability-type coverage, such as SVulD and DiverseVul, reflecting its capability to capture complex and diverse vulnerability patterns.
