*Result*: HySELoc: a hybrid semantic-enhanced approach for interpretable vulnerability localization.

Title:
HySELoc: a hybrid semantic-enhanced approach for interpretable vulnerability localization.
Authors:
Cao, Xiansheng1 (AUTHOR), Wang, Junfeng2 (AUTHOR), Wu, Peng3 (AUTHOR)
Source:
Computer Journal. Dec2025, Vol. 68 Issue 12, p2059-2071. 13p.
Database:
Academic Search Index

*Further Information*

*Early detection and localization of code vulnerabilities are crucial for software security. However, existing interpretable localization methods rely on attention over code sequences, failing to capture syntactic structures and semantic dependencies, limiting accuracy. Additionally, abstract syntax trees (ASTs), a widely used syntactic representation, suffer from node redundancy and alignment issues, while existing graph-based representations are overly complex and lack fine-grained semantic modeling, making them ineffective for interpretable vulnerability localization. To address these challenges, this paper proposes HySELoc, a hybrid semantic-enhanced framework that models context, syntax, and semantics across multiple levels by integrating code sequences, AST subtree sequences, and a tokenized hybrid semantic graph (THSG). AST subtree sequences segment ASTs at the statement level, while THSG, built at the token level, defines six semantic edge types to enhance interpretable localization. A hierarchical attention mechanism computes token-level contributions, adaptively weighting and fusing them for precise line-level localization. Experiments show HySELoc outperforms baseline methods in F1-score for vulnerability detection on REVEAL, D2A, and Big-Vul, with average absolute improvements in top-10 accuracy of 23.4 and 15.75 percentage points on D2A and Big-Vul, respectively. Additionally, it successfully detected two 0-day vulnerabilities (CVE-2024-6062/6064), validating its practical value. [ABSTRACT FROM AUTHOR]*