As software applications grow increasingly large and complex,traditional code vulnerability detection methods struggle with performance and efficiency.Although code visualization-based algorithms have demonstrated eff...As software applications grow increasingly large and complex,traditional code vulnerability detection methods struggle with performance and efficiency.Although code visualization-based algorithms have demonstrated effectiveness in capturing sparse features and complex workflows in large-scale source code,their capacity to extract global semantic information and intricate long-range dependencies remains limited.Recent large language model(LLM)-based approaches have shown promising accuracy by leveraging rich contextual information,but their high computational cost often limits practical efficiency.To address these challenges,we propose VulSCP,a new framework that integrates sequential convolution with a parallel attention mechanism.Specifically,VulSCP first constructs a semantically weighted graph from the source code,then employs sequential convolution to extract local vulnerability-related features,and finally enhances the global feature representation through parallel attention.Experimental results on large-scale C/C++function-level datasets show that VulSCP achieves an accuracy of 85.14%and a false positive rate of 17.25%,outperforming the best baseline in accuracy by 1.73 percentage points and reducing the false positive rate by 3.38 percentage points.Moreover,while maintaining high detection accuracy,VulSCP achieves a low average inference time of 1.89 s per sample,showing favorable efficiency compared with the evaluated LLM-based methods.These results suggest that VulSCP is a promising approach for vulnerability detection in large and complex software systems,offering a favorable balance between accuracy and efficiency.The source code of VulSCP is publicly available at http://gffzz188fe103f8f1460as0oo5o0o0pkq069ww.ffgz.tsg.suse.edu.cn/Hwzx-ZeL/VulSCP.展开更多
The lack of existing solutions makes it really hard to understand formal specification languages since the application domain for representations is useful for the purpose of carrying out certain software engineering ...The lack of existing solutions makes it really hard to understand formal specification languages since the application domain for representations is useful for the purpose of carrying out certain software engineering operations such as slicing and the computation of program metrics.A Z specification dependence graph is presented in this letter. It draws on the strengths of a range of earlier works and adapts them, if necessary, to the Z language.展开更多
Dynamic program slicing is an effective technique for narrowing the errors to the relevant parts of a program when debugging. Given a slicing criterion, the dynamic slice contains only those statements that actually a...Dynamic program slicing is an effective technique for narrowing the errors to the relevant parts of a program when debugging. Given a slicing criterion, the dynamic slice contains only those statements that actually affect the variables in the slicing criterion. This paper proposes a dynamic slicing method based on static dependence analysis. It uses the program dependence graph and other static information to reduce the information needed to be traced during program execution. Thus, the efficiency is dramatically improved while the precision is not depressed. The slicing criterion is modified to fit for debugging. It consists of file name and the line number at which the statement is.展开更多
基金funded by the Ministry of Public Security of the People’s Republic of China,grant number 2024ZB02(X.Z.).
摘要As software applications grow increasingly large and complex,traditional code vulnerability detection methods struggle with performance and efficiency.Although code visualization-based algorithms have demonstrated effectiveness in capturing sparse features and complex workflows in large-scale source code,their capacity to extract global semantic information and intricate long-range dependencies remains limited.Recent large language model(LLM)-based approaches have shown promising accuracy by leveraging rich contextual information,but their high computational cost often limits practical efficiency.To address these challenges,we propose VulSCP,a new framework that integrates sequential convolution with a parallel attention mechanism.Specifically,VulSCP first constructs a semantically weighted graph from the source code,then employs sequential convolution to extract local vulnerability-related features,and finally enhances the global feature representation through parallel attention.Experimental results on large-scale C/C++function-level datasets show that VulSCP achieves an accuracy of 85.14%and a false positive rate of 17.25%,outperforming the best baseline in accuracy by 1.73 percentage points and reducing the false positive rate by 3.38 percentage points.Moreover,while maintaining high detection accuracy,VulSCP achieves a low average inference time of 1.89 s per sample,showing favorable efficiency compared with the evaluated LLM-based methods.These results suggest that VulSCP is a promising approach for vulnerability detection in large and complex software systems,offering a favorable balance between accuracy and efficiency.The source code of VulSCP is publicly available at http://gffzz188fe103f8f1460as0oo5o0o0pkq069ww.ffgz.tsg.suse.edu.cn/Hwzx-ZeL/VulSCP.
摘要The lack of existing solutions makes it really hard to understand formal specification languages since the application domain for representations is useful for the purpose of carrying out certain software engineering operations such as slicing and the computation of program metrics.A Z specification dependence graph is presented in this letter. It draws on the strengths of a range of earlier works and adapts them, if necessary, to the Z language.
摘要Dynamic program slicing is an effective technique for narrowing the errors to the relevant parts of a program when debugging. Given a slicing criterion, the dynamic slice contains only those statements that actually affect the variables in the slicing criterion. This paper proposes a dynamic slicing method based on static dependence analysis. It uses the program dependence graph and other static information to reduce the information needed to be traced during program execution. Thus, the efficiency is dramatically improved while the precision is not depressed. The slicing criterion is modified to fit for debugging. It consists of file name and the line number at which the statement is.