arXiv:2510.10956cs.SEcs.AI2025-10中稿 · FSE'26被引 3

用指针知识图谱实现项目级C到Rust安全转换

Project-Level C-to-Rust Translation via Pointer Knowledge Graphs

  • 构建指针语义知识图谱,融合全局指针行为与Rust特性
  • 相比基线方法,不安全代码减少99.9%,功能正确率提升29.3%
  • 适合需要高安全性代码迁移的工程团队

将C代码翻译为安全的Rust是保障内存安全的有效方式。相较于规则驱动的方法(常生成大量不安全代码),基于大语言模型(LLM)的方法通过学习人类编写的代码,能生成更符合习惯且更安全的Rust代码。然而,现有基于LLM的方法在项目级C-to-Rust转换中仍存在不足:通常按调用图将项目切分为函数等小单元,采用自底向上的翻译策略以解决依赖问题,但因缺乏对指针使用的全局视角,难以有效处理指针。为此,本文提出一种新型的C-to-Rust指针知识图谱(KG),在代码依赖图基础上增加两类指针语义:(i) 指针使用信息,捕捉全局行为如点向流,并将底层结构交互抽象为高层概念;(ii) Rust导向注解,编码所有权、可变性、空值性及生命周期。基于该KG,我们进一步提出PtrTrans,使LLM获得全面的全局指针语义,从而生成安全且自然的Rust代码。实验表明,与规则和传统LLM方法相比,PtrTrans将翻译后不安全使用减少了99.9%;同时相比强化模糊测试的LLM方法,功能正确率提升29.3%。

原文摘要 · Abstract (English)

Translating C code into safe Rust is an effective way to ensure memory safety. Compared to rule-based approaches, which often produce largely unsafe Rust code, LLM-based methods generate more idiomatic and safer Rust by leveraging extensive training on human-written code. Despite their promise, existing LLM-based approaches still struggle with project-level C-to-Rust translation. They typically partition a C project into smaller units (e.g., functions) based on call graphs and translate them in a bottom-up manner to resolve dependencies. However, this unit-by-unit paradigm often fails to handle pointers due to the lack of a global view of their usage. To address this limitation, we propose a novel C-to-Rust Pointer Knowledge Graph (KG) that augments code dependency graphs with two types of pointer semantics: (i) pointer usage information, which captures global behaviors such as points-to flows and lifts low-level struct interactions to higher-level abstractions; and (ii) Rust-oriented annotations, which encode ownership, mutability, nullability, and lifetime. Building on this KG, we further propose PtrTrans, a project-level C-to-Rust translation approach. In PtrTrans, the KG provides LLMs with comprehensive global pointer semantics, guiding them to generate safe and idiomatic Rust code. Experimental results show that PtrTrans reduces unsafe usages in translated Rust by 99.9% compared to both rule-based and conventional LLM-based methods, while achieving 29.3% higher functional correctness than fuzzing-enhanced LLM approaches.

代码转换Rust安全指针分析知识图谱

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。