arXiv:2604.24822cs.SEcs.LG2026-04综述

系统梳理80篇基于Transformer的漏洞检测研究,揭示主流方法与关键挑战。

A systematic literature Review for Transformer-based Software Vulnerability detection

论文配图:A systematic literature Review for Transformer-based Software Vulnerability detection
图 1 · 摘自论文原文
  • 按编码器、解码器等架构分类分析80篇论文方法
  • 发现数据不平衡、可解释性差等共性技术难题
  • 适合安全研究者与模型开发者参考

软件漏洞对医疗、政府、金融等领域的系统安全构成重大威胁。近年来,得益于强大的上下文建模能力,基于Transformer的模型在自动识别漏洞方面展现出良好效果。本研究基于Kitchenham的系统文献综述指南,对2021至2025年间发表的80篇使用Transformer模型进行漏洞检测的研究进行了系统分析。从研究趋势、数据集与来源、编程语言、Transformer框架、检测粒度、评估指标、基线模型、漏洞类型及实验设置等多个维度展开评估。将模型分为编码器、解码器及混合架构,分析其在源代码、日志和智能合约上的预训练与微调应用。结果揭示了当前主流研究方向、常用基准与基线模型,同时指出现有技术中的关键问题:数据不平衡、可解释性不足、可扩展性差以及跨语言泛化能力弱。通过整合现有证据并识别未被充分探索的研究空白,本综述为研究人员和从业者提供了构建更可靠、精准且可解释的Transformer漏洞检测系统的综合参考。

原文摘要 · Abstract (English)

Context: Software vulnerabilities pose significant security threats to software systems, especially as software is increasingly used across many areas of daily life, including health, government, and finance. Recently, transformer-based models have demonstrated promising results in automatic software vulnerability identification due to their robust contextual modelling and representation learning capabilities. Objectives: While numerous systematic literature reviews (SLRs) have examined machine learning and deep learning methods for identifying vulnerabilities, a more transformer-centric analysis remains to be explored. This SLR critically analysed 80 studies published between 2021 and 2025 that utilised transformer models to identify software vulnerabilities. Methods: Using Kitchenhams SLR guidelines, we methodically evaluate current research from various perspectives, encompassing study trends, datasets and sources, programming languages, transformer frameworks, detection detail levels, assessment metrics, reference models, types of vulnerabilities, and experimental configurations. Results: We classify transformer models into encoder, decoder, and combined architectures and analyse both pre-trained and fine-tuned versions utilized on source code, logs, and smart contracts. The results emphasise prevailing research trends, frequently utilised benchmarks, and main baselines. It also uncovers crucial technical issues like data imbalance, interpretability, scalability, and generalization across programming languages. Conclusion: By integrating current evidence and recognising unaddressed research areas, this SLR provides a consolidated resource for researchers and professionals seeking to develop more reliable, precise, and interpretable transformer-based vulnerability identification systems.

漏洞检测Transformer系统综述代码安全

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。