🤖 AI Summary
This work proposes VulStyle, a novel approach to vulnerability detection that addresses two key limitations of existing methods: the neglect of risk-prone programming habits implicit in code style and the structural complexity introduced by full abstract syntax trees (ASTs). VulStyle is the first to incorporate code style (CStyle) as an auxiliary signal for vulnerability detection, integrating function-level source code, a pruned non-terminal AST, and stylistic features within a multimodal pre-training framework. This design preserves semantic hierarchy while reducing structural complexity and enables cross-language transferability. Experimental results demonstrate that VulStyle achieves F1 score improvements of 4%–48% over prior methods on the BigVul and VulDeePecker benchmarks and attains state-of-the-art or best average performance across five standard datasets.
📝 Abstract
We present VulStyle, a multi-modal software vulnerability detection model that jointly encodes function-level source code, non-terminal Abstract Syntax Tree (AST) structure, and code stylometry (CStyle) features. Prior work in code representation primarily leverages token-level models or full AST trees, often missing stylistic cues indicative of risky programming practices, or incurring high structural overhead. Our approach selects only non-terminal AST nodes, reducing input complexity while preserving semantic hierarchy, and integrates syntactic and lexical CStyle features as auxiliary vulnerability signals.
VulStyle is pre-trained using masked language modeling on 4.9M functions across seven programming languages, and fine-tuned across five benchmark datasets: Devign, BigVul, DiverseVul, REVEAL, and VulDeePecker. VulStyle achieves state-of-the-art performance on BigVul and VulDeePecker, improving F1 by 4-48% over strong transformer baselines, and attains competitive or best-average performance across all benchmarks. We contribute an ablation study isolating the effect of CStyle and AST structure, error case analysis, and a threat model situating the detection task in attacker-realistic scenarios.