Learning and Fusing Multi-View Code Representations for Function Vulnerability Detection

The explosive growth of vulnerabilities poses a significant threat to the security software systems. While various deep-learning-based vulnerability detection methods have emerged, they primarily rely on semantic features extracted from single code representation structure, which limits their ability detect hidden deep within code. To address this limitation, we propose S2FVD, short for Sequence and Structure Fusion-based Vulnerability Detector, fuses vulnerability-indicative learned multiple views more accurate detection. Specifically, S2FVD employs either well-matched or carefully extended neural network models extract token sequence, attributed control flow graph (ACFG) abstract syntax tree (AST) representations function, respectively. These capture different perspectives code, are then fused enable accurately that well-hidden function. experiments conducted two large datasets demonstrated superior performance against state-of-the-art approaches, with its accuracy F1 scores reaching 98.07% 98.14% respectively in detecting presence vulnerabilities, 97.93% 97.94%, respectively, pinpointing specific types. Furthermore, regard real-world dataset D2A, achieved average gains 6.86% 14.84% terms metrics, over baselines. This ablation study also confirms superiority fusing semantics implied distinct further enhance performance.