用大模型+静态分析，自动发现开源代码漏洞
QLPro: Automated Code Vulnerability Discovery via LLM and Static Code Analysis Integration
- 融合大模型与静态分析，全面扫描项目漏洞
- 在62个已知漏洞中检出41个，高于CodeQL的24个
- 发现6个未知漏洞，其中2个被确认为0日漏洞
我们提出QLPro，一个将大语言模型与静态分析工具系统集成的漏洞检测框架，可对整个开源项目进行全方位漏洞探测。构建了包含10个GitHub开源项目的全新数据集JavaTest，其中共含62个已确认漏洞。CodeQL作为先进静态分析工具仅检出24个漏洞，而QLPro检出41个。此外，QLPro还发现了6个此前未知的漏洞，其中2个已被证实为0日漏洞。
原文摘要 · Abstract (English)
We introduce QLPro, a vulnerability detection framework that systematically integrates LLMs and static analysis tools to enable comprehensive vulnerability detection across entire open-source projects.We constructed a new dataset, JavaTest, comprising 10 open-source projects from GitHub with 62 confirmed vulnerabilities. CodeQL, a state-of-the-art static analysis tool, detected only 24 of these vulnerabilities while QLPro detected 41. Furthermore, QLPro discovered 6 previously unknown vulnerabilities, 2 of which have been confirmed as 0-days.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。