•  
  •  
 

Abstract

Ensuring robust security in software development is essential due to the growing complexity of systems and the increasing prevalence of vulnerabilities. Existing vulnerability detection (VD) methods typically fall into two categories: multimodal single-language systems, which analyze vulnerabilities from multiple perspectives (e.g., source code and compiled code) but are limited to a single programming language, or unimodal multi-language systems, which focus on only one type of analysis (e.g., source code) while supporting multiple programming languages. These approaches, while effective in specific scenarios, often fail to comprehensively address security challenges due to their inherent limitations. This study introduces a deep learning-based, multimodal, multi-language framework that integrates source code with its compiled representations, namely, assembly code and Java bytecode, to provide a unified and comprehensive solution for vulnerability detection and classification. Our proposed system employs the pre-trained transformer-based model CodeBERT to generate code embeddings, which are processed by a Bidirectional Long Short-Term Memory (Bi-LSTM) models to detect and classify vulnerabilities into their respective Common Weakness Enumeration (CWE) types. The framework supports both C/C++ and Java, leveraging high-level logical flow analysis from source code and low-level memory management insights from compiled code, significantly enhancing its analysis capabilities. We evaluated the system using two datasets derived from the NIST Software Assurance Reference Dataset (SARD): one for C/C++ and the other for Java. In binary vulnerability detection, the system achieved a precision of 96%, recall of 95.4%, F1-score of 95.76%, and accuracy of 96% on the C/C++ dataset, and a precision, recall, F1-score, and accuracy of 94% each on the Java dataset. For multi-class vulnerability classification—measuring the correct categorization of vulnerabilities into specific CWE types—the system achieved an overall accuracy of 90% for C/C++ and 91% for Java. These results underscore the system's practicality and effectiveness in handling complex, real-world software environments.

Keywords

Bi-LSTM, CodeBERT, CWE, Multimodal deep learning, SARD, Vulnerability detection

Article Type

Article

First Page

1

Last Page

19

Publication Date

6-30-2026

Download

Share

COinS