用AI代理生成高保真漏洞数据,提升代码安全检测模型性能。
AVIATOR: Towards AI-Agentic Vulnerability Injection Workflow for High-Fidelity, Large-Scale Code Security Dataset
- 设计多智能体协作流程,结合AI推理与自纠错机制生成真实漏洞。
- 漏洞注入准确率91%-95%,覆盖范围和真实性优于现有方法。
- 适合用于训练深度学习漏洞检测模型,显著提升检测效果。
软件系统复杂度与网络攻击的日益严峻,凸显了自动化漏洞检测的需求。基于数据的深度学习方法虽具潜力,但严重依赖大规模、精准标注的数据集。现有数据集普遍存在标签噪声、漏洞覆盖不足或无法反映真实场景的问题,限制了大规模评估。自动化漏洞注入可缓解此问题,但现有技术在覆盖率、上下文保真度或注入成功率上仍有局限。本文提出AVIATOR,首个面向高保真、大规模代码安全数据集的AI代理式漏洞注入框架。该框架将漏洞注入分解为专业AI智能体协同、工具分析与迭代自校正的工作流,模拟专家推理过程。通过集成RAG与轻量化LoRA微调,生成无需人工规则即可实现类别特异性的真实漏洞。在三个基准测试中,AVIATOR实现91%-95%的高注入保真度,超越现有技术的准确性和漏洞覆盖。用于数据增强训练深度学习漏洞检测(DLVD)模型时,相比无增强提升平均F1分数22%,比VGX高25%,优于先前最优的LLM基模型VulScribeR,F1提升3%,召回率高出7%且精度未下降。其生成数据分布畸变最小,语法拒绝率低于2%,成本仅为VulScribeR的1/4.3。
原文摘要 · Abstract (English)
The increasing complexity of software systems and the sophistication of cyber-attacks have underscored the need for reliable automated software vulnerability detection. Data-driven approaches using deep learning models show promise but critically depend on the availability of large, accurately labeled datasets. Yet existing datasets either suffer from noisy labels, limited vulnerability coverage, or fail to reflect vulnerabilities as they occur in real-world software. This also limits large-scale benchmarking of such solutions. Automated vulnerability injection provides a way to address these limitations, but existing techniques remain limited in coverage, contextual fidelity, or injection success. In this paper, we present AVIATOR, the first AI-agentic vulnerability injection framework. AVIATOR decomposes vulnerability injection into a coordinated workflow of specialized AI agents, tool-based analysis, and iterative self-correction, explicitly mirroring expert reasoning. It integrates RAG and lightweight LoRA-based fine-tuning to produce realistic, category-specific vulnerabilities without relying on handcrafted patterns. Across three benchmarks, AVIATOR achieves high injection fidelity (91-95%) surpassing existing injection techniques in both accuracy and vulnerability coverage. When used for data augmentation to train deep learning-based vulnerability detection (DLVD) models, AVIATOR provides the strongest downstream gains in vulnerability detection. Across models and base datasets, AVIATOR improves average F1 scores by +22% over no augmentation, +25% over VGX, holding the prior best injection success rate, and +3% over VulScribeR, the prior state-of-the-art LLM-based injection model, with +7% higher recall and no precision loss. Its augmented data exhibits the lowest distributional distortion and scales efficiently with <2% syntax rejection at 4.3x lower cost than VulScribeR.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。