LLM助力代码漏洞检测,突破传统方法局限。
LLMs in Software Security: A Survey of Vulnerability Detection Techniques and Insights
- 系统梳理大模型在漏洞检测中的应用框架与技术路径。
- 总结多语言、跨库分析等核心挑战及现有解决方案。
- 适合安全研究者与工程团队跟进前沿进展。
大型语言模型(LLMs)正成为软件漏洞检测的变革性工具,应对传统静态与动态分析方法在效率、误报率及现代复杂系统面前的不足。通过分析代码结构、识别模式并生成修复建议,以GPT、BERT、CodeBERT为代表的模型为漏洞检测提供了新颖且可扩展的途径。本文全面综述了LLMs在漏洞检测中的应用,涵盖模型架构、使用方法、目标语言、微调策略、数据集与评估指标。分析当前研究问题的范围,揭示现有方法的优势与不足,并探讨跨语言检测、多模态数据融合与仓库级分析等挑战。基于此,提出针对数据集扩展性、模型可解释性及低资源场景的应用方案。贡献包括:(1) 系统性回顾LLMs在漏洞检测中的应用;(2) 建立统一框架,归纳研究共性与差异;(3) 梳理关键挑战与未来方向。该工作为推进基于大模型的漏洞检测提供重要参考。相关论文持续更新于https://github.com/OwenSanzas/LLM-For-Vulnerability-Detection。
原文摘要 · Abstract (English)
Large Language Models (LLMs) are emerging as transformative tools for software vulnerability detection, addressing critical challenges in the security domain. Traditional methods, such as static and dynamic analysis, often falter due to inefficiencies, high false positive rates, and the growing complexity of modern software systems. By leveraging their ability to analyze code structures, identify patterns, and generate repair suggestions, LLMs, exemplified by models like GPT, BERT, and CodeBERT, present a novel and scalable approach to mitigating vulnerabilities. This paper provides a detailed survey of LLMs in vulnerability detection. It examines key aspects, including model architectures, application methods, target languages, fine-tuning strategies, datasets, and evaluation metrics. We also analyze the scope of current research problems, highlighting the strengths and weaknesses of existing approaches. Further, we address challenges such as cross-language vulnerability detection, multimodal data integration, and repository-level analysis. Based on these findings, we propose solutions for issues like dataset scalability, model interpretability, and applications in low-resource scenarios. Our contributions are threefold: (1) a systematic review of how LLMs are applied in vulnerability detection; (2) an analysis of shared patterns and differences across studies, with a unified framework for understanding the field; and (3) a summary of key challenges and future research directions. This work provides valuable insights for advancing LLM-based vulnerability detection. We also maintain and regularly update latest selected paper on https://github.com/OwenSanzas/LLM-For-Vulnerability-Detection
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。