用大模型精炼代码分析结果，7倍提升漏洞检测准确率
The Hitchhiker's Guide to Program Analysis, Part II: Deep Thoughts by LLMs
- 设计结构化推理流程引导大模型验证代码约束
- 在Linux内核中将漏洞检测精度从10%提升至72%
- 自动发现4个此前未报告的漏洞，适合安全研究者使用
静态分析在软件漏洞检测中至关重要，但始终面临精度与可扩展性之间的权衡。在大型代码库（如Linux内核）中，传统工具因简化漏洞建模和路径/数据约束的过度近似，常产生大量误报。尽管大语言模型（LLMs）展现出良好的代码理解能力，但其内在推理局限性使其直接应用于程序分析仍不可靠。本文提出BugLens，一种后处理精炼框架，显著提升漏洞检测的精度。BugLens通过结构化推理步骤引导LLMs评估安全影响并验证源码中的约束条件。在基于静态分析工具检测到的Linux内核污染型漏洞上评估，BugLens使精度提升约7倍（从0.10增至0.72），大幅减少误报，并发现了4个此前未报告的漏洞。结果表明，一个良好设计的全自动大模型工作流能有效补充和增强传统静态分析技术。
原文摘要 · Abstract (English)
Static analysis plays a crucial role in software vulnerability detection, yet faces a persistent precision-scalability tradeoff. In large codebases like the Linux kernel, traditional static analysis tools often generate excessive false positives due to simplified vulnerability modeling and overapproximation of path and data constraints. While large language models (LLMs) demonstrate promising code understanding capabilities, their direct application to program analysis remains unreliable due to inherent reasoning limitations. We introduce BugLens, a post-refinement framework that significantly enhances static analysis precision for bug detection. BugLens guides LLMs through structured reasoning steps to assess security impact and validate constraints from the source code. When evaluated on Linux kernel taint-style bugs detected by static analysis tools, BugLens improves precision approximately 7-fold (from 0.10 to 0.72), substantially reducing false positives while uncovering four previously unreported vulnerabilities. Our results demonstrate that a well-structured, fully automated LLM-based workflow can effectively complement and enhance traditional static analysis techniques.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。