.png){kind=icon}
返回
Towards Explainable Vulnerability Detection With Large Language Models
.png){kind=icon}
PRE
AI
DOI：10.1109/TSE.2025.3605442.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Software vulnerabilities pose significant risks to the security and integrity of software systems. Although prior studies have explored vulnerability detection using deep learning and pre-trained models, these approaches often fail to provide the detailed explanations necessary for developers to understand and remediate vulnerabilities effectively. The advent of large language models (LLMs) has introduced transformative potential due to their advanced generative capabilities and ability to comprehend complex contexts, offering new possibilities for addressing these challenges. In this paper, we propose LLMVulExp, an automated framework designed to specialize LLMs for the dual tasks of vulnerability detection and explanation. To address the challenges of acquiring high-quality annotated data and injecting domain-specific knowledge, LLMVulExp leverages prompt-based techniques for annotating vulnerability explanations and fine-tunes LLMs using instruction tuning with Low-Rank Adaptation (LoRA), enabling LLMVulExp to detect vulnerability types in code while generating detailed explanations, including the cause, location, and repair suggestions. Additionally, we employ a Chain-of-Thought (CoT) based key code extraction strategy to focus LLMs on analyzing vulnerability-prone code, further enhancing detection accuracy and explanatory depth. We conducted experiments across multiple vulnerability detection settings on three benchmark datasets, demonstrating the effectiveness of our method. This study highlights the feasibility of utilizing LLMs for real-world vulnerability detection and explanation tasks, providing critical insights into their adaptation and application in software security.
Keyword:
Codes
Security
Tuning
Training
Large language models
Accuracy
Semantics
Location awareness
Data models
Reviews
Vulnerability detection
vulnerability explanation
large language model
instruction tuning
期刊
IF:
5.6
论文数:
2.9K
被引数:
1.1W
机构
引用论文
.png){kind=icon}
From Industrial Practices to Academia: Uncovering the Gap in Vulnerability Research and Practice
PREAI
分享收藏VulDeeLocator: A Deep Learning-Based Fine-Grained Vulnerability DetectorVulDeeLocator: 一种基于深度学习的细粒度漏洞检测器
OAAI
OAAI分享收藏SySeVR: A Framework for Using Deep Learning to Detect Software VulnerabilitiesSySeVR: 使用深度学习检测软件漏洞的框架OAAI
OAAI分享收藏Vulnerability Detection by Learning From Syntax-Based Execution Paths of Code通过基于语法的代码执行路径学习进行漏洞检测
PREAI
分享收藏
查看更多内容