VAlign-GLAR: Graph Retrieval-Based Vulnerability Intelligence Alignment via Structured LLM-Guided Inference

作者：Lihua Wang, Jiaojiao Jiang, Salil S. Kanhere, Jiamou Sun, Zhenchang Xing, Sanjay Jha · 年份：2025 · DOI：10.1145/3733800.3763266 · 被引用次数：1 · 研究领域：Advanced Graph Neural Networks、Information and Cyber Security、Web Application Security Vulnerabilities

Aligning vulnerability intelligence across heterogeneous repositories is crucial for unified threat management, but it poses significant challenges. Current approaches often frame alignment as a pairwise binary classification paradigm, which is unsuitable for practical retrieval tasks and plagued by extreme class imbalance, resulting in both false positives and negatives. Furthermore, these methods typically operate on isolated intra-repository graphs and struggle to capture fine-grained semantic distinctions crucial for accurate matching. To address these issues, we propose VAlign-GLAR, a hybrid framework that reframes alignment as a retrieval task, integrating Graph Neural Networks (GNNs) and Large Language Models (LLMs) through Retrieval Augmentation (RAG). VAlign-GLAR employs three key modules: (1) A Cross-repository graph retrieval stage builds a shared query–candidate graph and ranks nodes via a tri-factor score combining global path fit, local-hop match, and plausibility, restoring the cross-repository evidence absent in isolated embeddings. (2) A Retrieval Augmentation module utilises an LLM to proactively enrich sparse or incomplete vulnerability representations with inferred attributes and paths, bridging semantic gaps. (3) A Structured LLM-guided Inference module evaluates the integrated structural and semantic evidence via tailored prompts to verify and rank candidate alignments. Extensive experiments on the CERT-NVD and SF-NVD benchmark datasets confirm that VAli...