用大模型提升漏洞检测，降低误报率。
LLMpatronous: Harnessing the Power of LLMs For Vulnerability Detection
- 结合RAG与多智能体框架，增强模型上下文理解。
- 在多个开源项目中验证，误报率显著下降。
- 适合安全工程师与自动化测试团队使用。
尽管人工智能在各领域带来变革，网络安全仍依赖传统静态和动态分析工具，面临误报率高、代码理解浅显等问题。生成式AI虽能自动化开发流程，但利用大语言模型（LLMs）进行漏洞检测存在幻觉、上下文长度有限、知识截止等固有缺陷。以往基于机器学习的漏洞检测方法因现实适用性差、特征工程困难、缺乏上下文理解及难以适应不断演化的威胁环境而效果不佳。为此，本文提出一种鲁棒的AI驱动方法，旨在克服这些局限，确保基于大模型的漏洞检测质量与可靠性。通过创新融合检索增强生成（RAG）与多智能体（MoA）机制，充分发挥大模型优势，同时弥补其不足，为应对不断变化的软件安全挑战提供可靠高效的AI解决方案。
原文摘要 · Abstract (English)
Despite the transformative impact of Artificial Intelligence (AI) across various sectors, cyber security continues to rely on traditional static and dynamic analysis tools, hampered by high false positive rates and superficial code comprehension. While generative AI offers promising automation capabilities for software development, leveraging Large Language Models (LLMs) for vulnerability detection presents unique challenges. This paper explores the potential and limitations of LLMs in identifying vulnerabilities, acknowledging inherent weaknesses such as hallucinations, limited context length, and knowledge cut-offs. Previous attempts employing machine learning models for vulnerability detection have proven ineffective due to limited real-world applicability, feature engineering challenges, lack of contextual understanding, and the complexities of training models to keep pace with the evolving threat landscape. Therefore, we propose a robust AI-driven approach focused on mitigating these limitations and ensuring the quality and reliability of LLM based vulnerability detection. Through innovative methodologies combining Retrieval-Augmented Generation (RAG) and Mixtureof-Agents (MoA), this research seeks to leverage the strengths of LLMs while addressing their weaknesses, ultimately paving the way for dependable and efficient AI-powered solutions in securing the ever-evolving software landscape.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。