用大模型生成规则,自动检测Verilog代码漏洞。
VerilogLAVD: LLM-Aided Rule Generation for Vulnerability Detection in Verilog
- 构建代码图谱+大模型生成检测规则,提升结构理解能力。
- 在77个设计上达F1=0.54,优于纯大模型方案0.31以上。
- 适合硬件安全研究者与芯片开发人员快速排查漏洞。
早期设计阶段及时发现硬件漏洞可显著降低修复成本。现有技术多依赖专业安全知识,使用门槛高。近期尝试利用大语言模型(LLM)检测Verilog漏洞,但因难以捕捉代码结构,结果不稳定。为此,我们提出VerilogLAVD,首个基于大模型的图遍历规则生成方法。该方法引入Verilog属性图(VeriPG),融合抽象语法树(AST)的语法特征与控制流、数据依赖图的语义信息,构建统一表示。利用大模型从通用弱缺陷枚举(CWE)描述中生成基于VeriPG的检测规则,由规则执行器遍历图以发现潜在漏洞。为评估效果,我们构建了来自开源仓库和合成数据的测试集。在包含12类CWE的77个Verilog设计上,VerilogLAVD达到F1-score 0.54,较纯大模型基线提升0.31,较结合外部知识的基线提升0.27。
原文摘要 · Abstract (English)
Timely detection of hardware vulnerabilities during the early design stage is critical for reducing remediation costs. Existing early detection techniques often require specialized security expertise, limiting their usability. Recent efforts have explored the use of large language models (LLMs) for Verilog vulnerability detection. However, LLMs struggle to capture the structure in Verilog code, resulting in inconsistent detection results. To this end, we propose VerilogLAVD, the first LLM-aided graph traversal rule generation approach for Verilog vulnerability detection. Our approach introduces the Verilog Property Graph (VeriPG), a unified representation of Verilog code. It combines syntactic features extracted from the abstract syntax tree (AST) with semantic information derived from control flow and data dependency graphs. We leverage LLMs to generate VeriPG-based detection rules from Common Weakness Enumeration (CWE) descriptions. These rules guide the rule executor that traversal VeriPG for potential vulnerabilities. To evaluate VerilogLAVD, we build a dataset collected from open-source repositories and synthesized data. In our empirical evaluation on 77 Verilog designs encompassing 12 CWE types, VerilogLAVD achieves an F1-score of 0.54. Compared to the LLM-only and LLM with external knowledge baselines, VerilogLAVD improves F1-score by 0.31 and 0.27, respectively.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。