用大模型自动发现加密逻辑漏洞，准确率显著提升
CryptoScope: Utilizing Large Language Models for Automated Cryptographic Logic Vulnerability Detection
- 结合思维链与检索增强生成，利用超1.2万条加密知识库
- 在92个真实漏洞案例上，性能超越多个主流大模型
- 发现9个开源项目中未公开的加密缺陷，适合安全研究人员
密码算法是现代安全的基础，但其实现中常存在难以察觉的逻辑缺陷。我们提出CryptoScope，一种基于大语言模型（LLM）的自动化加密漏洞检测框架。该框架融合思维链（CoT）提示与检索增强生成（RAG），并依托包含超过12,000条记录的定制化密码学知识库。我们在LLM-CLVA基准上进行评估，该基准涵盖92个案例，主要源自真实世界CVE漏洞，辅以重大网络安全竞赛（CTF）中的密码挑战及11种编程语言的合成样本。CryptoScope持续优于多个强基线模型，在DeepSeek-V3上提升11.62%，GPT-4o-mini提升20.28%，GLM-4-Flash提升28.69%。此外，该方法成功识别出9个广泛使用的开源加密项目中此前未披露的漏洞。
原文摘要 · Abstract (English)
Cryptographic algorithms are fundamental to modern security, yet their implementations frequently harbor subtle logic flaws that are hard to detect. We introduce CryptoScope, a novel framework for automated cryptographic vulnerability detection powered by Large Language Models (LLMs). CryptoScope combines Chain-of-Thought (CoT) prompting with Retrieval-Augmented Generation (RAG), guided by a curated cryptographic knowledge base containing over 12,000 entries. We evaluate CryptoScope on LLM-CLVA, a benchmark of 92 cases primarily derived from real-world CVE vulnerabilities, complemented by cryptographic challenges from major Capture The Flag (CTF) competitions and synthetic examples across 11 programming languages. CryptoScope consistently improves performance over strong LLM baselines, boosting DeepSeek-V3 by 11.62%, GPT-4o-mini by 20.28%, and GLM-4-Flash by 28.69%. Additionally, it identifies 9 previously undisclosed flaws in widely used open-source cryptographic projects.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。