VulReaD: Knowledge-Graph-guided Software Vulnerability Reasoning and Detection
Fuente:
arXiv
Gespeichert in:
| Hauptverfasser: | , , , , , |
|---|---|
| Format: | Preprint |
| Veröffentlicht: |
2026
|
| Schlagworte: | |
| Online-Zugang: | |
| Tags: |
Tag hinzufügen
Keine Tags, Fügen Sie den ersten Tag hinzu!
|
| _version_ | 1866918332420063232 |
|---|---|
| author | Mukhtar, Samal Yao, Yinghua Sun, Zhu Mustafa, Mustafa Ong, Yew Soon Sun, Youcheng |
| author_facet | Mukhtar, Samal Yao, Yinghua Sun, Zhu Mustafa, Mustafa Ong, Yew Soon Sun, Youcheng |
| contents | Software vulnerability detection (SVD) is a critical challenge in modern systems. Large language models (LLMs) offer natural-language explanations alongside predictions, but most work focuses on binary evaluation, and explanations often lack semantic consistency with Common Weakness Enumeration (CWE) categories. We propose VulReaD, a knowledge-graph-guided approach for vulnerability reasoning and detection that moves beyond binary classification toward CWE-level reasoning. VulReaD leverages a security knowledge graph (KG) as a semantic backbone and uses a strong teacher LLM to generate CWE-consistent contrastive reasoning supervision, enabling student model training without manual annotations. Students are fine-tuned with Odds Ratio Preference Optimization (ORPO) to encourage taxonomy-aligned reasoning while suppressing unsupported explanations. Across three real-world datasets, VulReaD improves binary F1 by 8-10% and multi-class classification by 30% Macro-F1 and 18% Micro-F1 compared to state-of-the-art baselines. Results show that LLMs outperform deep learning baselines in binary detection and that KG-guided reasoning enhances CWE coverage and interpretability. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2602_10787 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | VulReaD: Knowledge-Graph-guided Software Vulnerability Reasoning and Detection Mukhtar, Samal Yao, Yinghua Sun, Zhu Mustafa, Mustafa Ong, Yew Soon Sun, Youcheng Software Engineering Artificial Intelligence Cryptography and Security Information Retrieval Software vulnerability detection (SVD) is a critical challenge in modern systems. Large language models (LLMs) offer natural-language explanations alongside predictions, but most work focuses on binary evaluation, and explanations often lack semantic consistency with Common Weakness Enumeration (CWE) categories. We propose VulReaD, a knowledge-graph-guided approach for vulnerability reasoning and detection that moves beyond binary classification toward CWE-level reasoning. VulReaD leverages a security knowledge graph (KG) as a semantic backbone and uses a strong teacher LLM to generate CWE-consistent contrastive reasoning supervision, enabling student model training without manual annotations. Students are fine-tuned with Odds Ratio Preference Optimization (ORPO) to encourage taxonomy-aligned reasoning while suppressing unsupported explanations. Across three real-world datasets, VulReaD improves binary F1 by 8-10% and multi-class classification by 30% Macro-F1 and 18% Micro-F1 compared to state-of-the-art baselines. Results show that LLMs outperform deep learning baselines in binary detection and that KG-guided reasoning enhances CWE coverage and interpretability. |
| title | VulReaD: Knowledge-Graph-guided Software Vulnerability Reasoning and Detection |
| topic | Software Engineering Artificial Intelligence Cryptography and Security Information Retrieval |
| url | https://arxiv.org/abs/2602.10787 |