用代码指标和大模型提前预警高危代码，防止安全漏洞出现
From Detection to Prevention: Explaining Security-Critical Code to Avoid Vulnerabilities
- 通过代码指标识别安全关键函数，如认证和输入处理
- 大模型生成可操作的预防建议，帮助开发者避免漏洞
- 适合开发人员在编码时实时获取安全指导
安全漏洞常因开发者缺乏安全知识或代码复杂性而无意引入。传统静态和动态分析工具只能在漏洞产生后发现，修复成本高。本文提出一种主动防御策略：通过识别代码中实现安全关键功能（如数据访问、认证、输入处理）的区域，并提供安全实现指导。我们开发了基于IntelliJ IDEA的插件原型，利用代码级软件度量识别潜在安全关键方法，并结合大语言模型（LLMs）生成预防导向的解释。在Spring-PetClinic项目上的初步评估表明，所选度量能识别出大多数已知安全关键方法，且LLM能提供可执行的预防性见解。尽管这些度量反映的是结构属性而非语义层面的安全性，本工作为代码级安全感知度量和增强解释奠定了基础。
原文摘要 · Abstract (English)
Security vulnerabilities often arise unintentionally during development due to a lack of security expertise and code complexity. Traditional tools, such as static and dynamic analysis, detect vulnerabilities only after they are introduced in code, leading to costly remediation. This work explores a proactive strategy to prevent vulnerabilities by highlighting code regions that implement security-critical functionality -- such as data access, authentication, and input handling -- and providing guidance for their secure implementation. We present an IntelliJ IDEA plugin prototype that uses code-level software metrics to identify potentially security-critical methods and large language models (LLMs) to generate prevention-oriented explanations. Our initial evaluation on the Spring-PetClinic application shows that the selected metrics identify most known security-critical methods, while an LLM provides actionable, prevention-focused insights. Although these metrics capture structural properties rather than semantic aspects of security, this work lays the foundation for code-level security-aware metrics and enhanced explanations.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。