[공지사항]을 빙자한 안부와 근황 
Show more

Daily Arxiv

This is a page that curates AI-related papers published worldwide.
All content here is summarized using Google Gemini and operated on a non-profit basis.
Copyright for each paper belongs to the authors and their institutions; please make sure to credit the source when sharing.

QLPro: Automated Code Vulnerability Discovery via LLM and Static Code Analysis Integration

Created by
  • Haebom

Author

Junze Hu, Xiangyu Jin, Yizhe Zeng, Yuling Liu, Yunpeng Li, Dan Du, Kaiyu Xie, Hongsong Zhu

Outline

QLPro is a vulnerability detection framework that systematically integrates LLMs and static analysis tools to enable comprehensive vulnerability detection across open source projects. When evaluated using a new dataset JavaTest consisting of 10 open source projects on GitHub (with 62 confirmed vulnerabilities), the state-of-the-art static analysis tool CodeQL detected only 24 vulnerabilities, while QLPro detected 41. Furthermore, QLPro discovered 6 previously unknown vulnerabilities, 2 of which were confirmed as 0-day vulnerabilities.

Takeaways, Limitations

Takeaways:
We demonstrate that integration of LLMs with static analysis tools can detect more vulnerabilities than traditional tools.
Has the potential to discover previously unknown vulnerabilities (including 0-day).
You can contribute to strengthening the security of open source projects.
Limitations:
The JavaTest dataset is relatively small in size.
Further research is needed to determine whether QLPro's performance would remain consistent across other programming languages or project types.
Additional validation is needed, as only two of the six new vulnerabilities discovered were confirmed as 0-day.
👍