HT-FVD: Hybrid Transformer Framework for Fine-Grained Vulnerability Detection in Third-Party Libraries

To address the limitations of existing methods in third-party library (TPL) vulnerability identification—such as poor cross-platform compatibility and incomplete vulnerability reports, we propose HT-FVD (Hybrid Transformer Framework for Fine-Grained Vulnerability Detection), a novel deep learning framework integrating pre-trained language models (PLMs) with custom Transformer layers. HT-FVD leverages multi-source features—including vulnerability descriptions, normalized Common Platform Enumeration (CPE) configurations, reference links, and Software Composition Analysis (SCA) database matches—which are encoded into fine-grained feature vectors via PLMs. These vectors are processed through a custom Transformer module with scaled dot-product attention and feed-forward networks to enable multi-label vulnerability classification. Evaluated on 7,696 vulnerability entities and 4,682 TPL labels, HT-FVD achieves state-of-the-art fine-grained detection performance with an average F1@k of 0.71, outperforming baselines by 6–7%. Ablation studies confirm its sensitivity to learning rates and architectural flexibility in adapting diverse PLMs. The framework eliminates platform-specific dependencies, providing a robust and extensible solution for secure TPL recommendation.