[공지사항]을 빙자한 안부와 근황 
Show more

Daily Arxiv

This is a page that curates AI-related papers published worldwide.
All content here is summarized using Google Gemini and operated on a non-profit basis.
Copyright for each paper belongs to the authors and their institutions; please make sure to credit the source when sharing.

QLPro: Automated Code Vulnerability Discovery via LLM and Static Code Analysis Integration

Created by
  • Haebom

Author

Junze Hu, Xiangyu Jin, Yizhe Zeng, Yuling Liu, Yunpeng Li, Dan Du, Kaiyu Xie, Hongsong Zhu

Outline

QLPro is a novel vulnerability detection framework that systematically integrates large-scale language models (LLMs) with static analysis tools to enable comprehensive vulnerability detection across open source projects. When evaluated using a new dataset, JavaTest, consisting of 10 open source projects on GitHub (containing 62 confirmed vulnerabilities), the state-of-the-art static analysis tool CodeQL detected only 24 vulnerabilities, while QLPro detected 41 vulnerabilities. In addition, QLPro discovered 6 previously unknown vulnerabilities, 2 of which were identified as 0-day vulnerabilities.

Takeaways, Limitations

Takeaways:
We demonstrate that integration of LLM with static analysis tools can effectively detect more vulnerabilities than existing tools.
Presents the possibility of discovering previously unknown vulnerabilities, including 0-day vulnerabilities.
Provides a new framework that can contribute to strengthening the security of open source projects.
Limitations:
The JavaTest dataset is relatively small in size.
Further research is needed to determine whether QLPro's performance remains similar across other programming languages or project types.
Additional analysis is needed to assess the severity and impact of the discovered vulnerabilities.
👍