用关系优先图提升复杂代码库的安全审计推理能力
Hound: Relation-First Knowledge Graphs for Complex-System Reasoning in Security Audits
- 构建关系优先的图结构，按安全分析需求灵活定义代码视图
- 在五项目基准上召回率提升至31.2%（基线8.3%），F1达14.2%
- 支持长期漏洞假设追踪，适合安全研究员与代码审计场景
Hound提出一种关系优先的图引擎，用于复杂代码库中跨组件的系统级推理。该智能体可设计灵活、分析师自定义的代码视图（如资金流、权限角色、调用图、协议不变式），并基于这些视图精准定位相关代码（常跨多个组件），实现全局结构与关键代码行的快速切换。第二项贡献是持久化信念系统：长期维护漏洞假设，并随证据积累动态更新置信度。智能体采用覆盖率与直觉结合的规划策略及问答验证模块，确认或排除假设。在ScaBench[1]的五个项目子集上，相较于基线大模型分析器，Hound的微召回率从8.3%提升至31.2%，F1从9.8%提升至14.2%，精度略有下降。性能提升归因于扩展了模型理解范围（超越调用/数据流至抽象关系）以及以假设为中心的迭代推理机制；代码与实验资产已公开，支持复现。
原文摘要 · Abstract (English)
Hound introduces a relation-first graph engine that improves system-level reasoning across interrelated components in complex codebases. The agent designs flexible, analyst-defined views with compact annotations (e.g., monetary/value flows, authentication/authorization roles, call graphs, protocol invariants) and uses them to anchor exact retrieval: for any question, it loads precisely the code that matters (often across components) so it can zoom out to system structure and zoom in to the decisive lines. A second contribution is a persistent belief system: long-lived vulnerability hypotheses whose confidence is updated as evidence accrues. The agent employs coverage-versus-intuition planning and a QA finalizer to confirm or reject hypotheses. On a five-project subset of ScaBench[1], Hound improves recall and F1 over a baseline LLM analyzer (micro recall 31.2% vs. 8.3%; F1 14.2% vs. 9.8%) with a modest precision trade-off. We attribute these gains to flexible, relation-first graphs that extend model understanding beyond call/dataflow to abstract aspects, plus the hypothesis-centric loop; code and artifacts are released to support reproduction.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。