Vulnerability classification is a crucial task in software security analysis, essential for identifying and mitigating potential security risks.Learning-based methods often perform poorly due to the long-tail distribution of vulnerability classification datasets.Recent approaches try to address the problem but treat each CWE class in isolation, ignoring their relationships.This results in non-scalable code vector representations, causing significant performance drops when handling complex realworld vulnerabilities.We propose a hierarchical contrastive learning framework for multiclass code vulnerability type classification to bring vector representations of related CWEs closer together.To address the issue of class collapse and enhance model robustness, we mix self-supervised contrastive learning loss into our loss function.Additionally, we employ max-pooling to enable the model to handle longer vulnerability code inputs.Extensive experiments demonstrate that our proposed framework outperforms state-of-the-art methods by 2.97%-17.90% on accuracy and 0.98%-22.27% on weighted-F1, with even better performance on higher-quality datasets.We also utilize an ablation study to prove each component's contribution.These findings underscore the potential and advantages of our approach in the multi-class vulnerability classification task.

Keeping open-source software (OSS) up to date is one potential solution to prevent known vulnerabilities. However, it requires frequent and costly testing and may introduce compatibility issues. Consequently, developers often choose to backport security patches to the vulnerable versions instead. Manual backporting is time-consuming, especially for large OSS such as the Linux kernel. Therefore, automating this process is urgently needed to save considerable time. Existing automated approaches for backporting patches involve either automatic patch generation or automatic patch migration. However, these methods are often ineffective and error-prone since they failed to locate the precise patch locations or generate the correct patch, operating only on the syntactic level.

With the development of the attack and defense technology, more and more network objects become the targets of cyber attack. However, these objects have different defense goals because of the different network functions and assets they have. Therefore, the defender needs to develop the optimal defense strategy based on their defense goals. Game theory based methods can help defender to develop the optimal defense strategy. However, there is no recognized effective method for utility calculation within the game theory model. In this paper, we introduced a hybrid model, which applied the analytic hierarchy process(AHP) on utility calculation and applied the attack-defense stochastic game model to develop the optimal defense strategy. Compared with previous methods, our model is more comprehensive and flexible, which is more competent to develop the optimal defense strategy, and through a case study, we demonstrated its effectiveness.