With a Little Help from My (LLM) Friends: Enhancing Static Analysis with LLMs to Detect Software Vulnerabilities
This paper explores the integration of Large Language Models (LLMs) with static analysis tools, specifically Semgrep, to enhance vulnerability detection in Java applications. Through a series of experiments, we evaluate the performance of various LLMs, including GPT-4, o1-mini, and others, in triaging security weaknesses identified by Semgrep. We also study how LLMs perform across different types of vulnerabilities and assess the impact of various prompt engineering strategies. Our results reveal that while some LLM models reduce the accuracy of baseline results with static analysis, they show a consistent improvement with each new model released. In particular, o1-mini significantly outperformed others in our experiments in terms of their accuracy and false positive reduction. While LLMs might not be ready for prime time in vulnerability detection yet, this study highlights their growing potential to complement existing tools and paves the way for future research to further optimize LLM-based vulnerability detection systems.
Sat 3 MayDisplayed time zone: Eastern Time (US & Canada) change
11:00 - 12:30 | |||
11:00 60mKeynote | Keynote 2: Towards Autonomous Language Model Systems (zoom talk) LLM4Code Ofir Press Princeton University | ||
12:00 10mTalk | With a Little Help from My (LLM) Friends: Enhancing Static Analysis with LLMs to Detect Software Vulnerabilities LLM4Code Amy Munson University of California, San Diego, Juanita Gomez University of California, Santa Cruz, Álvaro Cárdenas University of California, Santa Cruz | ||
12:10 10mTalk | Automating the Detection of Code Vulnerabilities by Analyzing GitHub Issues LLM4Code Daniele Cipollone Delft University of Technology, Changjie Wang KTH Royal Institute of Technology, Mariano Scazzariello RISE Research Institutes of Sweden, Simone Ferlin Red Hat, Maliheh Izadi Delft University of Technology, Dejan Kostic KTH Royal Institute of Technology, Marco Chiesa KTH Royal Institute of Technology | ||
12:20 10mTalk | COSMosFL: Ensemble of Small Language Models for Fault Localisation LLM4Code Pre-print |