用大模型检测代码漏洞，发现其效果优于传统方法。
Investigating Large Language Models for Code Vulnerability Detection: An Experimental Study
- 微调四大开源大语言模型进行漏洞检测。
- 在五个数据集上验证，长代码样本表现更优。
- 开源全部代码资源，适合安全研究者参考。
代码漏洞检测对保障软件安全至关重要。以往基于学习的方法多依赖微调中等规模序列模型或从头训练小型神经网络。近年来的大规模预训练语言模型（LLMs）在代码理解与生成等任务中表现突出，但其在漏洞检测中的有效性仍待深入探索。本文通过微调四种广泛使用的开源LLM开展实验，同时对比五种已有图模型及中等规模序列模型。实验在五个常用漏洞检测数据集上进行，涵盖短样本与长样本。此外，还定量分析了类别不平衡问题及不同长度样本的模型性能，这些问题在先前研究中较少涉及。为促进社区发展，本文公开所有代码与资源，链接见 https://github.com/SakiRinn/LLM4CVD 与 https://huggingface.co/datasets/xuefen/VulResource。
原文摘要 · Abstract (English)
Code vulnerability detection (CVD) is essential for addressing and preventing system security issues, playing a crucial role in ensuring software security. Previous learning-based vulnerability detection methods rely on either fine-tuning medium-size sequence models or training smaller neural networks from scratch. Recent advancements in large pre-trained language models (LLMs) have showcased remarkable capabilities in various code intelligence tasks including code understanding and generation. However, the effectiveness of LLMs in detecting code vulnerabilities is largely under-explored. This work aims to investigate the gap by fine-tuning LLMs for the CVD task, involving four widely-used open-source LLMs. We also implement other five previous graph-based or medium-size sequence models for comparison. Experiments are conducted on five commonly-used CVD datasets, including both the part of short samples and long samples. In addition, we conduct quantitative experiments to investigate the class imbalance issue and the model's performance on samples of different lengths, which are rarely studied in previous works. To better facilitate communities, we open-source all codes and resources of this study in https://github.com/SakiRinn/LLM4CVD and https://huggingface.co/datasets/xuefen/VulResource.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。