基于因果联系的漏洞检测多任务微调
作者:
作者单位:

作者简介:

通讯作者:

中图分类号:

基金项目:


Multi-task Fine-tuning for Vulnerability Detection Based on Causal Relationships
Author:
Affiliation:

Fund Project:

  • 摘要
  • |
  • 图/表
  • |
  • 访问统计
  • |
  • 参考文献
  • |
  • 相似文献
  • |
  • 引证文献
  • |
  • 资源附件
  • |
  • 文章评论
    摘要:

    软件代码的多样性和复杂性导致代码漏洞检测成为一个亟待解决的难题. 漏洞特征的上下文语义难以通过静态的规则来描述, 也缺乏大量的数据样本学习. 而代码大模型凭借其丰富的预训练知识, 成为解决代码漏洞检测问题的有效途径. 本文提出了一种基于因果联系的漏洞检测多任务微调方法VulDet, 其核心是结合漏洞认知、识别、分析、修复的漏洞检测全流程因果联系, 构建多任务微调体系, 将漏洞领域知识从多维度注入模型, 强化模型检测能力. 具体而言, 该方法基于CWE、CVE等权威数据库拆解漏洞领域知识, 设计覆盖漏洞定义理解、特征识别、成因分析和代码修复的因果递进式微调任务, 采用等权重联合训练, 实现多维度领域知识的有效融合. 在公开数据集上的测试结果显示, 所提方法优于主流基线模型, 显著提升了漏洞检测的精度与可靠性, 验证了该方法的有效性.

    Abstract:

    The diversity and complexity of software code make vulnerability detection a pressing challenge. The contextual semantics of vulnerability features are difficult to capture using static rules, and large-scale training data are scarce. However, large code models, leveraging their extensive pre-trained knowledge, have emerged as an effective approach to address this issue. This study proposes a vulnerability detection multi-task fine-tuning method based on causal relationships, VulDet. The key idea is to integrate causal relationships across the entire vulnerability detection process, including vulnerability understanding, identification, analysis, and remediation, in order to construct a multi-task fine-tuning framework that injects vulnerability domain knowledge into the model from multiple dimensions and enhances its detection capability. Specifically, this method decomposes vulnerability domain knowledge based on authoritative databases such as CWE and CVE, designs causally progressive fine-tuning tasks covering vulnerability definition understanding, feature identification, cause analysis, and code remediation, and adopts equal-weight joint training to achieve effective integration of multi-dimensional domain knowledge. Experimental results on public datasets show that the proposed method outperforms mainstream baseline models, significantly improving the accuracy and reliability of vulnerability detection, thus validating the effectiveness of the proposed method.

    参考文献
    相似文献
    引证文献
引用本文

郭佳雄,李涛,伍章驰,代雪晴,何柳.基于因果联系的漏洞检测多任务微调.计算机系统应用,2026,35(8):307-318

复制
分享
相关视频

文章指标
  • 点击次数:
  • 下载次数:
  • HTML阅读次数:
  • 引用次数:
历史
  • 收稿日期:2025-12-11
  • 最后修改日期:2026-01-22
  • 录用日期:
  • 在线发布日期: 2026-06-26
  • 出版日期:
文章二维码
您是第位访问者
版权所有:中国科学院软件研究所 京ICP备05046678号-3
地址:北京市海淀区中关村南四街4号,邮政编码:100190
电话:010-62661041 传真: Email:csa@iscas.ac.cn
技术支持:北京勤云科技发展有限公司

京公网安备 11040202500063号