VulRESC: A vulnerability detection framework based on risk path extraction and inter-procedural semantic completion

Abstract

Software vulnerability detection increasingly relies on learning-based models. However, most existing methods analyze individual functions in isolation, making it difficult to capture vulnerabilities caused by cross-function calls; directly introducing complete call chains can also lead to context expansion and noise accumulation. This paper proposes VulRESC, a vulnerability detection framework based on risk path extraction and interprocedural semantic completion. The method first constructs code property graphs and extracts call paths related to external inputs and high-risk operations through a riskpoint- driven pruning strategy. It then uses large language models to generate structured summaries for callees along the sequence in a bottom-up manner and introduces a variable-name alignment mechanism to bridge the semantic gap across function boundaries. Finally, the proposed DualVulBERT dual-stream model is employed to jointly identify vulnerabilities by fusing source code features and inter-procedural semantic summaries through cross-modal attention. Experimental results on real-world C/C++ vulnerability datasets show that VulRESC achieves an accuracy of 68.03% and an F1-score of 69.37%, outperforming representative existing methods.