用嵌入技术在行级精准检测Verilog代码中的常见漏洞
VeriCWEty: Embedding enabled Line-Level CWE Detection in Verilog
- 基于嵌入向量分析，实现模块与行级漏洞定位
- 对CWE-1244和CWE-1245等漏洞检测精度达89%
- 适合硬件安全审计与自动化代码审查场景
大型语言模型在寄存器传输级（RTL）代码生成方面取得显著进展，但生成的代码常包含未被察觉的常见漏洞与弱点（CWE），可能被攻击者利用。现有RTL漏洞检测方法依赖规则检查、形式化属性或粗粒度结构分析，难以捕捉语义级漏洞或提供精确定位。本文提出一种基于嵌入的漏洞检测框架，可在模块和行级粒度上识别并分类漏洞。该方法对CWE-1244和CWE-1245等常见漏洞的检测精度约为89%，行级漏洞检测准确率达96%。
原文摘要 · Abstract (English)
Large Language Models (LLMs) have shown significant improvement in RTL code generation. Despite the advances, the generated code is often riddled with common vulnerabilities and weaknesses (CWEs) that can slip by untrained eyes. Attackers can often exploit these weaknesses to fulfill their nefarious motives. Existing RTL bug-detection techniques rely on rule-based checks, formal properties, or coarse-grained structural analysis, which either fail to capture semantic vulnerabilities or lack precise localization. In our work, we bridge this gap by proposing an embedding-based bug-detection framework that detects and classifies bugs at both module and line-level granularity. Our method achieves about 89% precision in identifying common CWEs such as CWE-1244 and CWE-1245, and 96% accuracy in detecting line-level bugs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。