Scholarlink

<p>As the economic losses caused by software vulnerabilities continue to escalate, automated vulnerability detection has emerged as a crucial demand in software engineering. While current Large Language Model (LLM)-based approaches demonstrate promising capabilities for vulnerability detection, they still face significant challenges including susceptibility to non-vulnerability factors like code length, severe hallucination issues, and unsatisfactory detection accuracy and balance. To overcome these limitations, we propose DeepVulHunter, a novel multi-round detection framework that utilizes Retrieval Augmented Generation (RAG) technique to provide code snippets semantically similar to the target code and their associated vulnerability information. Extensive experiments conducted across five representative models from the Llama and Deepseek series confirm that our method effectively mitigates these challenges while enhancing both accuracy and balance in vulnerability detection tasks for general large models. The best-performing Llama-405B model achieves a detection accuracy of up to 75.3%, surpassing the current state-of-the-art approach that utilizes GPT-4 with Chain-of-Thought (CoT) prompting.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

DeepVulHunter: enhancing the code vulnerability detection capability of LLMs through multi-round analysis

  • 期刊论文

  • 发表日期：

    2025年9月16日

查看全文
  • Yutong Jiao,
  • Jiaxuan Han,
  • Cheng Huang

摘要

As the economic losses caused by software vulnerabilities continue to escalate, automated vulnerability detection has emerged as a crucial demand in software engineering. While current Large Language Model (LLM)-based approaches demonstrate promising capabilities for vulnerability detection, they still face significant challenges including susceptibility to non-vulnerability factors like code length, severe hallucination issues, and unsatisfactory detection accuracy and balance. To overcome these limitations, we propose DeepVulHunter, a novel multi-round detection framework that utilizes Retrieval Augmented Generation (RAG) technique to provide code snippets semantically similar to the target code and their associated vulnerability information. Extensive experiments conducted across five representative models from the Llama and Deepseek series confirm that our method effectively mitigates these challenges while enhancing both accuracy and balance in vulnerability detection tasks for general large models. The best-performing Llama-405B model achieves a detection accuracy of up to 75.3%, surpassing the current state-of-the-art approach that utilizes GPT-4 with Chain-of-Thought (CoT) prompting.