MCDM: A Multimodal Code Clone Detection Framework Fusing Source Code Semantics and Binary Representation

This article introduces the MCDM (Multimodal Code Clone Detection Model) framework, an innovative multimodal code clone detection method. By jointly leveraging source code semantics and binary-level representations, combining the UniXcoder and Vision Transformer (ViT) models, and using a cross-modal attention fusion mechanism, this framework significantly enhances the robustness of complex clone detection tasks. Its core design concept is that source code and binary code provide complementary information, and fusing both can build a more robust detection system.

Code clone detection is a fundamental task in software engineering, used to identify code fragments with identical or similar semantics. It has important applications in vulnerability propagation analysis, software maintenance, copyright protection, and malicious code detection. However, with the expansion of software scale and the maturity of obfuscation techniques, traditional methods based on syntactic similarity face challenges: attackers can alter the text form through renaming variables, refactoring control flow, inserting useless code, etc., making detection based on surface features ineffective.

Design Concept

The core concept of the MCDM framework: Source code retains the programmer's intent and high-level semantics, while binary code reflects the execution logic optimized by the compiler. Fusing the information from both can detect complex clone types that are difficult to identify with traditional methods.

Technical Architecture

1. Source Code Semantic Encoder: UniXcoder UniXcoder is a pre-trained model designed specifically for code understanding. Pre-trained on a large amount of open-source code, it learns semantic knowledge such as variable naming, API usage, and control flow structures, converting source code into high-dimensional semantic vectors.

2. Binary Representation Encoder: Vision Transformer Binary code is treated as a special 'image' (byte sequences arranged into a 2D matrix), and ViT is used to extract visual features. Its self-attention mechanism captures long-range dependencies in binary code and identifies functional patterns retained after compiler optimization.

3. Cross-modal Attention Fusion Mechanism This is the core innovation. It calculates cross-attention scores between the two modal representations to achieve deep interaction at the feature level. Instead of simple concatenation, it uses adaptive attention-guided information exchange, allowing each modality to obtain supplementary information from the other.

Contrastive Learning Framework

Using triplet training samples (anchor code, positive sample, negative sample), optimize the contrastive loss function to map functionally identical code to similar vector spaces and push functionally different code apart, enhancing the ability to distinguish subtle changes.

Multi-task Joint Training

Simultaneously optimize auxiliary tasks such as code classification and code summary generation to improve the model's generalization ability, make representations more robust and interpretable, and enhance performance in zero-shot scenarios.

Hard Example Mining Strategy

Dynamically identify confusing hard samples, assign higher training weights to them, allow the model to focus on learning discriminative features, and solve the class imbalance problem.

Benchmark Datasets

Evaluated on standard datasets such as BigCloneBench, POJ-104, and Google Code Jam, covering from simple syntactic clones to complex semantic clones, to comprehensively test detection capabilities.

Performance

Achieved leading performance on all benchmarks, especially when detecting obfuscated code clones, with a significant improvement over baseline models using only source code or binary. Cross-modal fusion combines the advantages of both, and when one modality is disturbed, the other still provides reliable support.

Robustness Analysis

Adversarial tests show that MCDM has strong resistance to transformations such as variable renaming, loop unrolling, and conditional refactoring, maintaining a high accuracy level, while traditional methods' performance drops sharply.

1. Vulnerability Propagation Tracking: When a component vulnerability is discovered, quickly scan the codebase to find similar vulnerability pattern fragments, even if they have been modified.

2. Code Copyright Protection: Compare suspected infringing code with the own codebase to identify potential plagiarism, even if the infringing party has deeply modified the code.

3. Malware Detection: Identify malware variants, which can still be detected even after attackers recompile and obfuscate them.

Limitations

1. It mainly targets compiled languages such as C/C++ and Java; support for interpreted languages like Python and JavaScript needs further research.
2. The cross-modal fusion has high computational overhead; efficiency optimization is required for applications in ultra-large-scale codebases.

Future Directions

Explore more lightweight fusion mechanisms and extend the framework to more programming languages and platforms.