用轻量方法提升大模型识别C++漏洞提交的能力
CLNX: Bridging Code and Natural Language for C/C++ Vulnerability-Contributing Commits Identification
- 通过结构与词级自然化，将代码转为更易理解的自然语言表示
- 在25,872个函数上测试，使CodeBERT达到新最好性能
- 可实际发现38个开源项目真实漏洞，适合安全检测场景
大型语言模型（LLMs）在漏洞识别方面展现出巨大潜力。由于过去十年中一半的开源软件（OSS）漏洞来自C/C++，且开源更新主要通过提交（commits）发生，因此提升LLM识别C/C++漏洞贡献提交（VCCs）的能力至关重要。然而，现有研究多依赖在海量代码数据集上进一步预训练LLM，资源消耗大且效率低。本文提出一种轻量级方法CodeLinguaNexus（CLNX），作为连接C/C++程序与LLM的桥梁。基于提交信息，CLNX高效地将源码转化为更具自然语言特性的表示，同时保留关键细节。具体包括：先进行结构级自然化以分解复杂程序，再进行词级自然化以解析复杂符号。我们在包含25,872个C/C++函数及其提交的公开数据集上评估了CLNX。结果表明，CLNX显著提升了LLM在识别C/C++ VCCs上的表现。此外，搭载CLNX的CodeBERT实现了新的最佳性能，并在真实世界中识别出38个开源漏洞。
原文摘要 · Abstract (English)
Large Language Models (LLMs) have shown great promise in vulnerability identification. As C/C++ comprises half of the Open-Source Software (OSS) vulnerabilities over the past decade and updates in OSS mainly occur through commits, enhancing LLMs' ability to identify C/C++ Vulnerability-Contributing Commits (VCCs) is essential. However, current studies primarily focus on further pre-training LLMs on massive code datasets, which is resource-intensive and poses efficiency challenges. In this paper, we enhance the ability of BERT-based LLMs to identify C/C++ VCCs in a lightweight manner. We propose CodeLinguaNexus (CLNX) as a bridge facilitating communication between C/C++ programs and LLMs. Based on commits, CLNX efficiently converts the source code into a more natural representation while preserving key details. Specifically, CLNX first applies structure-level naturalization to decompose complex programs, followed by token-level naturalization to interpret complex symbols. We evaluate CLNX on public datasets of 25,872 C/C++ functions with their commits. The results show that CLNX significantly enhances the performance of LLMs on identifying C/C++ VCCs. Moreover, CLNX-equipped CodeBERT achieves new state-of-the-art and identifies 38 OSS vulnerabilities in the real world.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。