用知识图谱引导大模型精准定位漏洞类型，解释更可信。
VulReaD: Knowledge-Graph-guided Software Vulnerability Reasoning and Detection
- 用安全知识图谱构建语义骨架，生成符合漏洞分类标准的推理监督信号。
- 在三个真实数据集上，多类检测宏平均准确率提升30%，微平均提升18%。
- 适合需要可解释漏洞检测的开发者与安全研究人员使用。
软件漏洞检测是现代系统中的关键挑战。大语言模型（LLMs）能提供自然语言解释，但多数研究仅关注二元判断，且解释常与通用弱弱点枚举（CWE）类别语义不一致。我们提出VulReaD，一种基于知识图谱的漏洞推理与检测方法，从二元分类迈向CWE级别的推理。VulReaD以安全知识图谱（KG）为语义核心，利用强教师型LLM生成与CWE一致的对比推理监督信号，使学生模型无需人工标注即可训练。学生模型通过奇偶比偏好优化（ORPO）微调，强化分类体系对齐性并抑制无依据解释。在三个真实世界数据集上，VulReaD相比最先进基线，二元检测F1提升8-10%，多类分类宏平均F1提升30%，微平均F1提升18%。结果表明，LLMs在二元检测中优于深度学习基线，而知识图谱引导的推理显著提升CWE覆盖度与可解释性。
原文摘要 · Abstract (English)
Software vulnerability detection (SVD) is a critical challenge in modern systems. Large language models (LLMs) offer natural-language explanations alongside predictions, but most work focuses on binary evaluation, and explanations often lack semantic consistency with Common Weakness Enumeration (CWE) categories. We propose VulReaD, a knowledge-graph-guided approach for vulnerability reasoning and detection that moves beyond binary classification toward CWE-level reasoning. VulReaD leverages a security knowledge graph (KG) as a semantic backbone and uses a strong teacher LLM to generate CWE-consistent contrastive reasoning supervision, enabling student model training without manual annotations. Students are fine-tuned with Odds Ratio Preference Optimization (ORPO) to encourage taxonomy-aligned reasoning while suppressing unsupported explanations. Across three real-world datasets, VulReaD improves binary F1 by 8-10% and multi-class classification by 30% Macro-F1 and 18% Micro-F1 compared to state-of-the-art baselines. Results show that LLMs outperform deep learning baselines in binary detection and that KG-guided reasoning enhances CWE coverage and interpretability.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。