QLPro: Automated Code Vulnerability Discovery via LLM and Static Code Analysis Integration
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2025
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866908456608333824 |
|---|---|
| author | Hu, Junze Jin, Xiangyu Zeng, Yizhe Liu, Yuling Li, Yunpeng Du, Dan Xie, Kaiyu Zhu, Hongsong |
| author_facet | Hu, Junze Jin, Xiangyu Zeng, Yizhe Liu, Yuling Li, Yunpeng Du, Dan Xie, Kaiyu Zhu, Hongsong |
| contents | We introduce QLPro, a vulnerability detection framework that systematically integrates LLMs and static analysis tools to enable comprehensive vulnerability detection across entire open-source projects.We constructed a new dataset, JavaTest, comprising 10 open-source projects from GitHub with 62 confirmed vulnerabilities. CodeQL, a state-of-the-art static analysis tool, detected only 24 of these vulnerabilities while QLPro detected 41. Furthermore, QLPro discovered 6 previously unknown vulnerabilities, 2 of which have been confirmed as 0-days. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2506_23644 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | QLPro: Automated Code Vulnerability Discovery via LLM and Static Code Analysis Integration Hu, Junze Jin, Xiangyu Zeng, Yizhe Liu, Yuling Li, Yunpeng Du, Dan Xie, Kaiyu Zhu, Hongsong Software Engineering Artificial Intelligence Cryptography and Security We introduce QLPro, a vulnerability detection framework that systematically integrates LLMs and static analysis tools to enable comprehensive vulnerability detection across entire open-source projects.We constructed a new dataset, JavaTest, comprising 10 open-source projects from GitHub with 62 confirmed vulnerabilities. CodeQL, a state-of-the-art static analysis tool, detected only 24 of these vulnerabilities while QLPro detected 41. Furthermore, QLPro discovered 6 previously unknown vulnerabilities, 2 of which have been confirmed as 0-days. |
| title | QLPro: Automated Code Vulnerability Discovery via LLM and Static Code Analysis Integration |
| topic | Software Engineering Artificial Intelligence Cryptography and Security |
| url | https://arxiv.org/abs/2506.23644 |