  Software vulnerabilities pose significant risks to computer systems,
impacting our daily lives, productivity, and even our health. Identifying and
addressing security vulnerabilities in a timely manner is crucial to prevent
hacking and data breaches. Unfortunately, current vulnerability identification
methods, including classical and deep learning-based approaches, exhibit
critical drawbacks that prevent them from meeting the demands of the
contemporary software industry. To tackle these issues, we present JFinder, a
novel architecture for Java vulnerability identification that leverages quad
self-attention and pre-training mechanisms to combine structural information
and semantic representations. Experimental results demonstrate that JFinder
outperforms all baseline methods, achieving an accuracy of 0.97 on the CWE
dataset and an F1 score of 0.84 on the PROMISE dataset. Furthermore, a case
study reveals that JFinder can accurately identify four cases of
vulnerabilities after patching.
