{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,6]],"date-time":"2026-02-06T00:09:36Z","timestamp":1770336576353,"version":"3.49.0"},"reference-count":34,"publisher":"MDPI AG","issue":"2","license":[{"start":{"date-parts":[[2026,2,5]],"date-time":"2026-02-05T00:00:00Z","timestamp":1770249600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Major Program of the National Natural Science Foundation of China","award":["62192733"],"award-info":[{"award-number":["62192733"]}]},{"name":"Major Program of the National Natural Science Foundation of China","award":["62192730"],"award-info":[{"award-number":["62192730"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Future Internet"],"abstract":"<jats:p>Deep learning has become an important approach for automated software vulnerability detection. However, due to domain shift, existing models often suffer from significant performance degradation when applied to unseen projects. To address this issue, prior studies have widely adopted Domain Adaptation (DA) techniques to improve cross-project generalization. Nevertheless, these methods typically rely on the implicit \u201cproject-as-domain\u201d assumption and require access to target project data during training, which limits their applicability in practice. To overcome these limitations, this paper proposes a vulnerability detection framework that combines semantic clustering with ensemble-based Domain Generalization (DG), termed Cluster-based Ensemble Learning for Vulnerability Detection (CEVD). CEVD first performs unsupervised clustering on code semantic embeddings to automatically automatically identify latent semantic structures that transcend project boundaries, constructing pseudo-domains with intra-domain homogeneity. A soft domain labeling strategy is further introduced to model the membership of samples in multiple pseudo-domains, preserving semantic overlap across boundaries. Building upon this, CEVD employs an ensemble learning framework that jointly trains multiple expert models and a domain classifier. The predictions of these experts are dynamically fused based on the weights generated by the domain classifier, enabling effective vulnerability detection on unseen projects without requiring access to target data. Extensive experiments on real-world datasets demonstrate that CEVD consistently outperforms state-of-the-art baselines across different pre-trained backbone models. This work demonstrates the effectiveness of semantic structure mining in capturing latent domains and offers a practical solution for improving generalization in cross-project vulnerability detection.<\/jats:p>","DOI":"10.3390\/fi18020085","type":"journal-article","created":{"date-parts":[[2026,2,5]],"date-time":"2026-02-05T11:13:01Z","timestamp":1770289981000},"page":"85","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["CEVD: Cluster-Based Ensemble Learning for Cross-Project Vulnerability Detection"],"prefix":"10.3390","volume":"18","author":[{"ORCID":"https:\/\/orcid.org\/0009-0005-3856-9184","authenticated-orcid":false,"given":"Yang","family":"Cao","sequence":"first","affiliation":[{"name":"School of Software, Northwestern Polytechnical University, Xi\u2019an 710129, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9882-9121","authenticated-orcid":false,"given":"Yunwei","family":"Dong","sequence":"additional","affiliation":[{"name":"School of Software, Northwestern Polytechnical University, Xi\u2019an 710129, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jie","family":"Liu","sequence":"additional","affiliation":[{"name":"School of Software, Northwestern Polytechnical University, Xi\u2019an 710129, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2026,2,5]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3699711","article-title":"A Systematic Literature Review on Automated Software Vulnerability Detection Using Machine Learning","volume":"57","author":"Harzevili","year":"2025","journal-title":"ACM Comput. Surv."},{"key":"ref_2","unstructured":"Zhou, Y., Liu, S., Siow, J., Du, X., and Liu, Y. (2019, January 8\u201314). Devign: Effective Vulnerability Identification by Learning Comprehensive Program Semantics via Graph Neural Networks. Proceedings of the 33rd International Conference on Neural Information Processing Systems, Vancouver, BC, Canada."},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Fu, M., and Tantithamthavorn, C. (2022, January 23\u201324). LineVul: A Transformer-based Line-Level Vulnerability Prediction. Proceedings of the 19th International Conference on Mining Software Repositories (MSR \u201922), Pittsburgh, PA, USA.","DOI":"10.1145\/3524842.3528452"},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"438","DOI":"10.1109\/TDSC.2020.2984505","article-title":"CD-VulD: Cross-Domain Vulnerability Discovery Based on Deep Domain Adaptation","volume":"19","author":"Liu","year":"2022","journal-title":"IEEE Trans. Depend. Sec. Comput."},{"key":"ref_5","first-page":"8052","article-title":"Generalizing to Unseen Domains: A Survey on Domain Generalization","volume":"35","author":"Wang","year":"2023","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"103017","DOI":"10.1016\/j.cose.2022.103017","article-title":"Cross-Domain Vulnerability Detection Using Graph Embedding and Domain Adaptation","volume":"125","author":"Li","year":"2023","journal-title":"Comput. Secur."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Nguyen, V., Le, T., Le, T., Nguyen, K., DeVel, O., Montague, P., Qu, L., and Phung, D. (2019, January 14\u201319). Deep Domain Adaptation for Vulnerable Code Function Identification. Proceedings of the 2019 International Joint Conference on Neural Networks (IJCNN), Budapest, Hungary.","DOI":"10.1109\/IJCNN.2019.8851923"},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"4152","DOI":"10.1109\/TSE.2023.3285910","article-title":"CPVD: Cross Project Vulnerability Detection Based On Graph Attention Network And Domain Adaptation","volume":"49","author":"Zhang","year":"2023","journal-title":"IIEEE Trans. Softw. Eng."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"112038","DOI":"10.1016\/j.jss.2024.112038","article-title":"CSVD-TF: Cross-project Software Vulnerability Detection with TrAdaBoost by Fusing Expert Metrics and Semantic Metrics","volume":"213","author":"Cai","year":"2024","journal-title":"J. Syst. Softw."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Ni, C., Shen, L., Yang, X., Zhu, Y., and Wang, S. (2024, January 15\u201316). MegaVul: A C\/C++ Vulnerability Dataset with Comprehensive Code Representations. Proceedings of the 21st IEEE\/ACM International Conference on Mining Software Repositories, MSR 2024, Lisbon, Portugal.","DOI":"10.1145\/3643991.3644886"},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Feng, Z., Guo, D., Tang, D., Duan, N., Feng, X., Gong, M., Shou, L., Qin, B., Liu, T., and Jiang, D. (2020, January 16\u201320). CodeBERT: A Pre-Trained Model for Programming and Natural Languages. Proceedings of the Findings of the Association for Computational Linguistics: EMNLP 2020, Online.","DOI":"10.18653\/v1\/2020.findings-emnlp.139"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"189","DOI":"10.1007\/978-3-319-58347-1_10","article-title":"Domain-Adversarial Training of Neural Networks","volume":"17","author":"Ganin","year":"2017","journal-title":"Adv. Comput. Vis. Pattern Recognit."},{"key":"ref_13","unstructured":"McQueen, J.B. (1967). Some Methods of Classification and Analysis of Multivariate Observations. Proceedings of the 5th Berkeley Symposium on Mathematical Statistics and Probability, University of California Press."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"264","DOI":"10.1145\/331499.331504","article-title":"Data Clustering: A Review","volume":"31","author":"Jain","year":"1999","journal-title":"ACM Comput. Surv."},{"key":"ref_15","first-page":"100","article-title":"Text Clustering with Large Language Model Embeddings","volume":"6","author":"Petukhova","year":"2025","journal-title":"Int. J. Cogn. Comput. Eng."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Ethayarajh, K. (2019, January 3\u20137). How Contextual Are Contextualized Word Representations? Comparing the Geometry of BERT, ELMo, and GPT-2 Embeddings. Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), Hong Kong, China.","DOI":"10.18653\/v1\/D19-1006"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Han, J., Kamber, M., and Pei, J. (2012). Cluster Analysis: Basic Concepts and Methods. Data Mining: Concepts and Techniques, Morgan Kaufmann. [3rd ed.].","DOI":"10.1016\/B978-0-12-381479-1.00010-1"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Mancini, M., Bul\u00f2, S.R., Caputo, B., and Ricci, E. (2018). Best Sources Forward: Domain Generalization through Source-Specific Nets. arXiv.","DOI":"10.1109\/ICIP.2018.8451318"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Fan, J., Li, Y., Wang, S., and Nguyen, T.N. (2020, January 29\u201330). A C\/C++ Code Vulnerability Dataset with Code Changes and CVE Summaries. Proceedings of the 17th International Conference on Mining Software Repositories, Seoul, Republic of Korea.","DOI":"10.1145\/3379597.3387501"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Yang, X., Wang, S., Li, Y., and Wang, S. (2023, January 14\u201320). Does Data Sampling Improve Deep Learning-Based Vulnerability Detection? Yeas! and Nays!. Proceedings of the 45th IEEE\/ACM International Conference on Software Engineering, ICSE 2023, Melbourne, Australia.","DOI":"10.1109\/ICSE48619.2023.00192"},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"2244","DOI":"10.1109\/TDSC.2021.3051525","article-title":"SySeVR: A Framework for Using Deep Learning to Detect Software Vulnerabilities","volume":"19","author":"Li","year":"2021","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Rahman, M.M., Ceka, I., Mao, C., Chakraborty, S., Ray, B., and Le, W. (2024, January 14\u201320). Towards Causal Deep Learning for Vulnerability Detection. Proceedings of the IEEE\/ACM 46th International Conference on Software Engineering, Lisbon, Portugal.","DOI":"10.1145\/3597503.3639170"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Hanif, H., and Maffeis, S. (2022, January 18\u201323). VulBERTa: Simplified Source Code Pre-Training for Vulnerability Detection. Proceedings of the 2022 International Joint Conference on Neural Networks (IJCNN), Padua, Italy.","DOI":"10.1109\/IJCNN55064.2022.9892280"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Bozorgi, M., Saul, L.K., Savage, S., and Voelker, G.M. (2010, January 24\u201328). Beyond Heuristics: Learning to Classify Vulnerabilities and Predict Exploits. Proceedings of the 16th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Washington, DC, USA.","DOI":"10.1145\/1835804.1835821"},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"772","DOI":"10.1109\/TSE.2010.81","article-title":"Evaluating Complexity, Code Churn, and Developer Activity Metrics as Indicators of Software Vulnerabilities","volume":"37","author":"Shin","year":"2011","journal-title":"IEEE Trans. Softw. Eng."},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Padmanabhuni, B.M., and Tan, H.B.K. (2014, January 3\u20136). Predicting Buffer Overflow Vulnerabilities through Mining Light-Weight Static Code Attributes. Proceedings of the 2014 IEEE International Symposium on Software Reliability Engineering Workshops, Naples, Italy.","DOI":"10.1109\/ISSREW.2014.26"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Russell, R., Kim, L., Hamilton, L., Lazovich, T., Harer, J., Ozdemir, O., Ellingwood, P., and McConley, M. (2018, January 17\u201320). Automated Vulnerability Detection in Source Code Using Deep Representation Learning. Proceedings of the 2018 17th IEEE International Conference on Machine Learning and Applications (ICMLA), Orlando, FL, USA.","DOI":"10.1109\/ICMLA.2018.00120"},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Feng, H., Fu, X., Sun, H., Wang, H., and Zhang, Y. (2020, January 6\u20139). Efficient Vulnerability Detection Based on Abstract Syntax Tree and Deep Learning. Proceedings of the IEEE INFOCOM 2020\u2014IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS), Toronto, ON, Canada.","DOI":"10.1109\/INFOCOMWKSHPS50562.2020.9163061"},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Dam, H.K., Pham, T., Ng, S.W., Tran, T., Grundy, J.C., Ghose, A., Kim, T., and Kim, C.J. (2019, January 26\u201327). Lessons Learned from Using a Deep Tree-Based Model for Software Defect Prediction in Practice. Proceedings of the 16th International Conference on Mining Software Repositories, MSR 2019, Montreal, QC, Canada.","DOI":"10.1109\/MSR.2019.00017"},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"3280","DOI":"10.1109\/TSE.2021.3087402","article-title":"Deep Learning Based Vulnerability Detection: Are We There Yet?","volume":"48","author":"Chakraborty","year":"2022","journal-title":"IIEEE Trans. Softw. Eng."},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"5120","DOI":"10.1109\/TIFS.2024.3392536","article-title":"Vulnerability Detection Based on Enhanced Graph Representation Learning","volume":"19","author":"Xiao","year":"2024","journal-title":"IEEE Trans. Inform. Forensic Secur."},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Niu, C., Li, C., Luo, B., and Ng, V. (2022, January 23\u201329). Deep Learning Meets Software Engineering: A Survey on Pre-Trained Models of Source Code. Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence, Vienna, Austria.","DOI":"10.24963\/ijcai.2022\/775"},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"111623","DOI":"10.1016\/j.jss.2023.111623","article-title":"CSGVD: A Deep Learning Approach Combining Sequence and Graph Embedding for Source Code Vulnerability Detection","volume":"199","author":"Tang","year":"2023","journal-title":"J. Syst. Softw."},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"699","DOI":"10.1007\/978-3-030-47426-3_54","article-title":"Dual-Component Deep Domain Adaptation: A New Approach for Cross Project Software Vulnerability Detection","volume":"Volume 12084","author":"Nguyen","year":"2020","journal-title":"Advances in Knowledge Discovery and Data Mining"}],"container-title":["Future Internet"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1999-5903\/18\/2\/85\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,2,5]],"date-time":"2026-02-05T11:20:23Z","timestamp":1770290423000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1999-5903\/18\/2\/85"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,2,5]]},"references-count":34,"journal-issue":{"issue":"2","published-online":{"date-parts":[[2026,2]]}},"alternative-id":["fi18020085"],"URL":"https:\/\/doi.org\/10.3390\/fi18020085","relation":{},"ISSN":["1999-5903"],"issn-type":[{"value":"1999-5903","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,2,5]]}}}