With the increasing scale and complexity of software, the advantages of using neural networks for static vulnerability detection are becoming increasingly prominent. Before inputting into a neural network, the source code needs to undergo word embedding, transforming discrete high-dimensional text data into low-dimensional continuous vectors suitable for training in neural networks. However, analysis has revealed that different implementation ideas by code writers for the same functionality can lead to varied code implementation methods. Embedding different code texts into vectors results in distinctions that can reduce the robustness of a model. To address this issue, this paper explores the impact of converting source code into different forms on word embedding and finds that a TAC (Three-Address Code) can significantly eliminate noise caused by different code implementation approaches. Given the excellent capability of a GNN (Graph Neural Network) in handling non-Euclidean space data and complex features, this paper subsequently employs a GNN to learn and classify vulnerabilities by capturing the implicit syntactic structure information in a TAC. Based on this, this paper introduces TACSan, a novel static vulnerability detection system based on a GNN designed to detect vulnerabilities in C/C++ programs. TACSan transforms the preprocessed source code into a TAC representation, adds control and data edges to create a graph structure, and then inputs it into the GNN for training. Comparative testing and evaluation of TACSan against other renowned static analysis tools, such as VulDeePecker and Devign, demonstrate that TACSan’s detection capabilities not only exceed those methods but also achieve substantial enhancements in accuracy and F1 score.

The Three Gorges Reservoir (TGR) in China is one of the world’s largest hydropower projects. Interval inflow, originating from ungauged areas between the upstream gauging control stations (Zhutuo, Beibei, Wulong) and the TGR dam site, is a critical component of total reservoir inflow, but its hydrological characteristics have not been fully clarified. The accurate estimation and prediction of interval inflow are essential for reservoir safety and flood control operations. Using daily hydrological data from 2009 to 2017, we propose an integrated analytical framework combining (i) flow travel time estimation using cross-correlation analysis, (ii) multi-scale statistical characterization, and (iii) K-means clustering with bootstrap validation and algorithm comparison. This framework systematically identified hydrological regimes of interval inflow and their associated flood control risks. The key findings are as follows. (1) The optimal flow travel time from the upstream gauging stations to the dam site is 1 day (correlation coefficient $\rho =0.9809,p<0.001$), and it remains stable across different flow regimes. (2) The interval inflow exhibited a highly right-skewed distribution (mean 1279 m³/s, standard deviation 1651 m³/s) and contributed on average 10.1% to the total inflow. The contribution ratio exhibited an inverted U-shaped relationship with increasing total inflow, peaking at 11.4% when the total inflow ($Q$) was 13,014 m³/s. The quartile thresholds were 5788 m³/s, 9575 m³/s, and 16,869 m³/s (corresponding to Q1, Q2, and Q3, respectively), and the 10th and 90th percentiles (P10 and P90) were 4865 m³/s and 24,625 m³/s, respectively. (3) Five distinct hydrological patterns (C1–C5) were successfully identified, among which Cluster C4 (5.7% of days) was defined as the high-impact pattern based on reservoir operational criteria, with a mean $I$ of 6425 m³/s, a mean $R$ of 27.8% (up to 44% in extreme events), a mean flood duration of 5.8 days, a mean flood volume of 36.1 × 10⁸ m³, and a flashiness index of 1.48. (4) C4 is predominantly triggered by localized heavy rainfall, and its flashy nature implies a substantially shorter forecast lead time compared with mainstream-dominated floods, posing major challenges to real-time reservoir operations. This study demonstrates that interval inflow risk is pattern-dependent and that the proposed framework provides a scientific basis for developing pattern-specific reservoir operation strategies. The proposed framework is transferable to other large river-type reservoirs facing similar ungauged interval inflow challenges.

As the directed greybox fuzzing (DGF) technique advances, it is being extensively utilized in various fields such as defect reproduction, patch testing, and vulnerability identification. Nevertheless, current DGFs waste a significant amount of resources due to their simplistic distance definitions and overly straightforward energy distribution for the seeds. To address these issues, a dynamic distance-weighting-based distance estimation strategy is proposed first, which facilitates strategies for seed distribution that take energy into consideration. Second, to overcome the limitations of current seed energy distribution strategies, the gray wolf optimizer (GWO) is improved by integrating four strategies, leading to the development of the improved gray wolf optimizer (IGWO). Lastly, an adaptive search algorithm is proposed, and the WolfFuzz prototype tool is implemented. In vulnerability recurrence scenarios, WolfFuzz is 3.2× faster on average compared with the baseline and reproduces 76.4% of existing bugs faster. WolfFuzz also discovers nine different types of bugs in seven real-world programs.