The sequence model ignores the code structure information, which leads to high false alarm rate, Graph Neural Network (GNN) has insufficient semantic modeling of data dependence, and production repair lacks the verification mechanism of security constraints and does not realize the closed loop of detection-repair-verification. Therefore, this paper proposes the framework of Multimodal Graph Attention Network (MGAT) to realize the automatic identification and repair of complex software vulnerabilities. Firstly, the framework extracts abstract syntax tree (AST) and control flow graph (CFG) through static analysis, constructs joint graph structure, and designs attention mechanism to capture syntax details and control dependencies synchronously. Node features are initialized by CodeBERT pre-training model to integrate code semantic apriori. Secondly, the comparative learning mechanism is introduced, and the InfoNCE loss function is used to construct positive and negative sample pairs to enhance the generalization ability of the model to the mutation vulnerability pattern, Finally, based on reinforcement learning (RL), the patch generation is modeled as a sequential decision-making process, and a three-stage reward mechanism is designed to ensure the correctness of the repair and avoid introducing new vulnerabilities. Experiments on Devign data set show that the F1 score of MGAT vulnerability detection reaches 84.6%, which is 5.3 percentage points higher than the optimal baseline CodeBERT. The patch module achieves 85.0% vulnerability elimination rate, and 94.5% generated patches can be verified by compilation. The framework provides an effective solution for automatic security reinforcement of complex software systems through multi-modal feature depth fusion and multi-stage verification mechanism.
Li et al. (Sun,) studied this question.