.png){kind=icon}
.png){kind=icon}
Return
VulLIC: Vulnerability classification method based on LLM code explanations and images
.png){kind=icon}
PRE
AI
DOI：10.1007/s11219-026-09741-y.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
The continuous increase in software vulnerabilities poses a serious threat to the security of software systems. It imposes higher demands on the efficiency and effectiveness of vulnerability management. As a result, classifying vulnerabilities efficiently and accurately has become essential for improving vulnerability response and remediation processes. Nevertheless, many existing approaches heavily depend on manually written vulnerability descriptions, which are often subjective and prone to inaccuracies. To address these limitations, we propose a new vulnerability classification method, VulLIC, which combines large language model (LLM) vulnerability code explanations with image-based visual representation. Firstly, the method utilizes LLM to automatically generate vulnerability code explanations for vulnerable code segments, thereby replacing the traditional manual vulnerability descriptions. Secondly, we use the Program Dependence Graph (PDG) to model source code to extract the betweenness centrality, closeness centrality, and PageRank centrality features of the nodes, and use them to construct a three-channel image representation. Then the vulnerability code explanation is embedded using BERT and input into BiLSTM-Attention to extract semantic features. The image information is embedded using sent2vec and processed by TextCNN to capture local structural features. Finally, we use the attention mechanism to achieve the fusion of vulnerability code explanations and image information and construct dual-modal joint features for the vulnerability classification. We conduct experiments on the Big-Vul dataset, and the results show that VulLIC performs competitively across multiple metrics, achieving a Weighted_P of 87.57%, Weighted_R of 86.37%, and Weighted_F1 of 86.58%.
Keywords:
Vulnerability classification
LLM
PDG
TextCNN
Attention mechanism