FedMVA: Enhancing software vulnerability assessment via federated multimodal learning

Abstract

Software Vulnerability Assessment plays a crucial role in identifying and evaluating security vulnerabilities in software systems and prioritizing their resolution. However, as concerns about data privacy and security continue to grow, traditional vulnerability assessment methods struggle to balance effectiveness with privacy protection, particularly in heterogeneous data environments. To address this challenge, we propose a novel federated multimodal vulnerability assessment framework (FedMVA), designed with privacy preservation at its core. FedMVA leverages federated learning, enabling local model training without sharing data, thereby protecting sensitive information while ensuring efficient vulnerability evaluation. Our framework also incorporates multimodal data, including code structure, lexical features, and developer comments, fully utilizing the complementary nature of these modalities. We introduce a weighted variance minimization loss function to improve the alignment between local and global models and adopt a momentum-based weight allocation strategy with a dynamic learning rate mechanism to enhance the model's robustness and adaptability across diverse data environments. Extensive ablation studies demonstrate that FedMVA outperforms existing methods in multiple performance metrics, significantly improving the precision of vulnerability assessment. This work highlights the advantages of integrating multimodal data within a federated learning framework, providing an innovative and promising solution for effective and privacy-preserving vulnerability assessment in complex software systems. Editor's note: Open Science material was validated by the Journal of Systems and Software Open Science Board.