We present VulStyle, a multi-modal software vulnerability detection model that jointly encodes function-level source code, non-terminal Abstract Syntax Tree (AST) structure, and code stylometry (CStyle) features. Prior work in code representation primarily leverages token-level models or full AST trees, often missing stylistic cues indicative of risky programming practices, or incurring high structural overhead. Our approach selects only non-terminal AST nodes, reducing input complexity while preserving semantic hierarchy, and integrates syntactic and lexical CStyle features as auxiliary vulnerability signals. VulStyle is pre-trained using masked language modeling on 4.9M functions across seven programming languages, and fine-tuned across five benchmark datasets: Devign, BigVul, DiverseVul, REVEAL, and VulDeePecker. VulStyle achieves state-of-the-art performance on BigVul and VulDeePecker, improving F1 by 4-48% over strong transformer baselines, and attains competitive or best-average performance across all benchmarks. We contribute an ablation study isolating the effect of CStyle and AST structure, error case analysis, and a threat model situating the detection task in attacker-realistic scenarios.

翻译：我们提出了VulStyle，一种多模态软件漏洞检测模型，该模型联合编码函数级源代码、非终结符抽象语法树结构以及代码风格特征。现有代码表示研究主要依赖词级模型或完整语法树，往往遗漏能指示高风险编程实践的代码风格线索，或产生较高的结构开销。我们的方法仅选取非终结符AST节点，在降低输入复杂度的同时保留语义层次，并将句法与词法层面的CStyle特征作为辅助漏洞信号进行集成。VulStyle采用掩码语言建模方式，在涵盖七种编程语言的490万函数上进行预训练，并在Devign、BigVul、DiverseVul、REVEAL及VulDeePecker五个基准数据集上完成微调。VulStyle在BigVul与VulDeePecker数据集上取得了最优性能，相较于强Transformer基线模型，F1值提升4%至48%，并在所有基准测试中均达到具有竞争力或最优的平均性能。我们贡献了探究CStyle与AST结构影响的消融分析、错误案例剖析，以及在攻击者真实场景下定位检测任务的威胁模型。