CVE Semantic: Learning Logic Vulnerability Patterns through Semantic Analysis of CVE Fix Differentials

Traditional vulnerability detection systems rely on syntactic pattern matching, failing to capture the semantic logic errors responsible for critical software vulnerabilities. We propose CVE Semantic, a novel framework that learns semantic vulnerability transformations directly from CVE fix differentials. By analyzing the transformation from vulnerable to secure code, CVE Semantic captures the underlying logical structures of security flaws, enabling detection of previously unseen vulnerabilities across programming languages and execution contexts. Our approach employs a hybrid architecture combining Graph Neural Networks with Transformer-based Line-level Semantic Learning (CSLS) and hierarchical memory clustering. We release a seed dataset of 109 vulnerable functions from 36 CVEs across 26 repositories spanning 6 programming languages, with an automated pipeline targeting 20,784 vulnerable functions across 162 weakness types from 547 open-source projects. Leveraging AWS Bedrock for intent extraction and OpenSearch for vector retrieval, the system achieves continuous evolution through real-time ingestion of new CVE fixes. Experimental evaluation targets demonstrate F1 scores of 68% on Devign, 55% on ReVeal, and 60% on PrimeVul, with cross-language transfer achieving average F1 of 58% across Java, Python, and Go.