Scholarlink

<p>Software vulnerability detection is a critical task in software engineering to ensure system security. Recently, pre-trained models have shown great potential in automating vulnerability detection. However, existing pre-trained model-based vulnerability detection approaches still suffer from the following issues: (1) They struggle to accurately parse the complex expressions with multiple operators and pointers. (2) They fail to capture various code execution sequences effectively. To mitigate these issues, we propose VulTrLM, a vulnerability detection framework that decomposes Abstract Syntax Trees (ASTs) with the assistance of Large Language Models (LLMs). To improve code semantics, VulTrLM leverages an improved decomposition algorithm to partition the AST into multiple subtrees, each paired with comments generated by LLMs. To enhance execution sequence sensitivity, we designed a Transformer-based semantic aggregator, which models relationships between subtrees and merges their features into a target vulnerability vector. Finally, VulTrLM incorporates the vulnerability vector to effectively capture vulnerability patterns. Experimental results showed that VulTrLM achieves a higher F1 score than baselines with improvements of 1.87% on FFMPeg+Qemu, 4.82% on Reveal, and 12.46% on SVulD. Moreover, VulTrLM can remain effective across different pre-trained models, and the ablation studies also validate the effectiveness of VulTrLM’s core design.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

VulTrLM: LLM-assisted vulnerability detection via AST decomposition and comment enhancement

  • 期刊论文

  • 发表日期：

    2025年11月5日

查看全文
  • Shaobo Zhang,
  • Qianzhi Wang,
  • Qin Liu,
  • Entao Luo,
  • Tao Peng

摘要

Software vulnerability detection is a critical task in software engineering to ensure system security. Recently, pre-trained models have shown great potential in automating vulnerability detection. However, existing pre-trained model-based vulnerability detection approaches still suffer from the following issues: (1) They struggle to accurately parse the complex expressions with multiple operators and pointers. (2) They fail to capture various code execution sequences effectively. To mitigate these issues, we propose VulTrLM, a vulnerability detection framework that decomposes Abstract Syntax Trees (ASTs) with the assistance of Large Language Models (LLMs). To improve code semantics, VulTrLM leverages an improved decomposition algorithm to partition the AST into multiple subtrees, each paired with comments generated by LLMs. To enhance execution sequence sensitivity, we designed a Transformer-based semantic aggregator, which models relationships between subtrees and merges their features into a target vulnerability vector. Finally, VulTrLM incorporates the vulnerability vector to effectively capture vulnerability patterns. Experimental results showed that VulTrLM achieves a higher F1 score than baselines with improvements of 1.87% on FFMPeg+Qemu, 4.82% on Reveal, and 12.46% on SVulD. Moreover, VulTrLM can remain effective across different pre-trained models, and the ablation studies also validate the effectiveness of VulTrLM’s core design.