Research map / Detection and segmentation / CNN features
Suitable is the Best: Task-Oriented Knowledge Fusion in Vulnerability Detection
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes KF-GVD, a GNN-based vulnerability detector that fuses task-specific vulnerability knowledge (sensitive functions, module-specific rules) into a SAGPool-style graph model via fine-tuning on misclassified target samples, evaluated on Linux kernel and CWE subtype tasks.
Problem
General-purpose deep learning vulnerability detectors apply uniform feature learning across entire target sets and perform poorly on code with diverse functional modules or vulnerability subtypes.
Approach
Injects task-oriented vulnerability knowledge by masking CPG nodes weakly related to a target task and fusing knowledge-subgraph node features during fine-tuning of a source-trained GNN, with misclassified samples prioritized for fusion.
Key results
- On Tm119 KF-GVD reaches F1 95.7% on Fs-module-level target versus 65.2% for GVD-ft (fine-tuned baseline without fusion), per Table 1.
- Abstract reports average increases of 40.9% precision and 26.1% recall over SOTAs across target tasks.
- KF-GVD discovered 9 undisclosed vulnerabilities in C/C++ open-source projects (e.g., Assimp, boost, frr), submitted to CNNVD.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| fuse task-oriented vulnerability knowledge | GVD-ft on Linux kernel modules and CWE-119 subtypes · Tm119 and Tsub function-level | F1: 23.3% for Tm119; 15.7% for Tsub | Helped |
| fuse task-oriented vulnerability knowledge | GVD-ft on Linux kernel modules · Tm416 function-level | F1: 31.6% | Helped |
| add vulnerability-type knowledge K1 (ablation) | GVD on Tm119 · Tm119 | F1: 11.9% | Helped |
| add task-customized knowledge K2 (ablation) | GVD on Tm119 · Tm119 | F1: 16.3% | Helped |
| add vulnerability-type knowledge K1 (ablation) | GVD on Tsub · Tsub | F1: 15.1% | Helped |
| add task-customized knowledge K2 (ablation) | GVD on Tsub · Tsub | F1: 7.5% | Helped |
| fuse K1 and K2 together (ablation) | GVD on Tm119 and Tsub · Tm119 and Tsub | F1: 23.3% for Tm119; 15.7% for Tsub | Helped |
| replace CFG with CPG representation (ablation) | KF-GVD · S119 and target tasks | F1: +27.1% average on target tasks | Helped |
| replace Code2Seq embeddings with Word2Vec embeddings (ablation) | KF-GVD · S119 and target tasks | F1 | Helped |
| vary the number of fused samples (ablation) | KF-GVD · Tm119 and Tsub | F1: 0.3-0.5 | Mixed |
| increase fusion coefficient β beyond the effective range (ablation) | KF-GVD · target tasks | F1: 1.5-2 | Hurt |
| apply task-fused model to its source task (ablation) | KF-GVD · S416 | F1: -0.17 | No clear effect |
Surprising findings
- Large code models (CodeLlama, WizardCoder) performed worse than the GNN approach on vulnerability classification, which the authors attribute to these models being trained for generative rather than classification tasks.
- Performance on cross-domain tasks gains were much smaller (average 5.4% F1) than on CWE-specific target tasks (22.6%).
Limitations
- Cannot detect vulnerabilities with cross-function or cross-file dependencies.
- Performance depends on availability of target-specific historical vulnerability knowledge; without it, degrades to generalized model.
- Only validated on C/C++ code.
Experimental setup
Datasets: NVD CWE-119 and CWE-416 commits from 13 C++ projects SARD synthetic data Linux kernel target modules (Tm) CWE-125 and CWE-787 subtypes (Tsub) FFmpeg and OpenSSL cross-domain data
Benchmarks: S119 S416 Tm119 Tm416 Tsub cross-domain Linux/FFmpeg/OpenSSL tasks
Metrics: precision recall F1 MAP@5
Baselines: Cppcheck Flawfinder Sysver VulCNN CodeBERT Code Llama WizardCoder Devign ReGVD IVDetect LineVul LineVD
Builds on: SAGPool IVDetect LineVD Devign
Closest papers by meaning
- KDAT: Inherent Adversarial Robustness via Knowledge Distillation with Adversarial Tuning for Object Detection Models (AAAI 2025 · similarity 0.80)
- A Large-Scale Multi-Source Dataset Linking Hacker Community Discourse to the CVE Vulnerability Lifecycle (NeurIPS 2026 · similarity 0.80)
- MTVHunter: Smart Contracts Vulnerability Detection Based on Multi-Teacher Knowledge Translation (AAAI 2025 · similarity 0.79)
- SecCodePRM: A Process Reward Model for Code Security (ICML 2026 · similarity 0.79)
- IRIS: LLM-Assisted Static Analysis for Detecting Security Vulnerabilities (ICLR 2025 · similarity 0.79)
- Kernel-Aware Graph Prompt Learning for Few-Shot Anomaly Detection (AAAI 2025 · similarity 0.79)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.