.png){kind=icon}
Return
Towards Explainable Vulnerability Detection With Large Language Models
.png){kind=icon}
PRE
AI
DOI：10.1109/TSE.2025.3605442.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Software vulnerabilities pose significant risks to the security and integrity of software systems. Although prior studies have explored vulnerability detection using deep learning and pre-trained models, these approaches often fail to provide the detailed explanations necessary for developers to understand and remediate vulnerabilities effectively. The advent of large language models (LLMs) has introduced transformative potential due to their advanced generative capabilities and ability to comprehend complex contexts, offering new possibilities for addressing these challenges. In this paper, we propose LLMVulExp, an automated framework designed to specialize LLMs for the dual tasks of vulnerability detection and explanation. To address the challenges of acquiring high-quality annotated data and injecting domain-specific knowledge, LLMVulExp leverages prompt-based techniques for annotating vulnerability explanations and fine-tunes LLMs using instruction tuning with Low-Rank Adaptation (LoRA), enabling LLMVulExp to detect vulnerability types in code while generating detailed explanations, including the cause, location, and repair suggestions. Additionally, we employ a Chain-of-Thought (CoT) based key code extraction strategy to focus LLMs on analyzing vulnerability-prone code, further enhancing detection accuracy and explanatory depth. We conducted experiments across multiple vulnerability detection settings on three benchmark datasets, demonstrating the effectiveness of our method. This study highlights the feasibility of utilizing LLMs for real-world vulnerability detection and explanation tasks, providing critical insights into their adaptation and application in software security.
Keywords:
Codes
Security
Tuning
Training
Large language models
Accuracy
Semantics
Location awareness
Data models
Reviews
Vulnerability detection
vulnerability explanation
large language model
instruction tuning
Journal
IF:
5.6
Papers:
2.9K
Citations:
1.1W
Organization
Cited Papers
.png){kind=icon}
ShareSaveFrom Industrial Practices to Academia: Uncovering the Gap in Vulnerability Research and Practice
PREAI
ShareSaveShareSave
ShareSave
View more