一句话：SEVDF 用污点分析提取候选路径、再由 LLM 做语义分段与可行性确认，高效检测 C/C++ 路径敏感漏洞。
路径敏感漏洞（如 use-after-free、整数溢出、命令注入）使传统静态分析工具在精度、可扩展性与可解释性之间难以兼顾。本文提出 SEVDF（Semantic-Enhanced Vulnerability Detection Framework），将 may 分析的污点传播与大语言模型（LLM）相结合：先构建程序依赖图并执行可靠但不完备的污点分析，提取所有潜在脆弱路径；随后对路径进行分段、去重、可行性检查与语义摘要，把路径重构为“逻辑单元”，再由 LLM 确认其跨过程可行性与语义一致性。作者在 Juliet 测试套件（13 个 CWE 类别）与涵盖 9 个项目、71 个漏洞的真实数据集上评估，SEVDF 持续优于 CodeQL 默认规则、去除多余约束的 CodeQL 规则以及 Infer、Cppcheck、CodeChecker 三个开源检测器，在若干 CWE 上达到 100% 精度并保持或提升召回；基于分段的设计相比直接路径提示将 LLM 分析工作量降低 90.6%。此外，SEVDF 发现并报告 29 个 0-day 漏洞（12 个已确认，含 VirtualBox 中 3 个 CVE），体现实际价值。
Path-sensitive vulnerabilities, such as use-after-free, integer overflows, and command injection, pose significant challenges for traditional static analysis tools, which often face trade-offs between precision, scalability, and interpretability. To address these challenges, we present SEVDF (Semantic-Enhanced Vulnerability Detection Framework), a novel methodology that integrates may-analysis taint propagation with large language models (LLMs) to detect path-related vulnerabilities in large C/C++ codebases. SEVDF begins by constructing a program dependency graph and performing a sound but incomplete taint analysis to extract all potential vulnerable paths. After segmentation, deduplication, feasibility check, and semantic summarization by LLMs, the vulnerable paths are reformed and confirmed with LLMs for their inter-procedural feasibility and semantic consistency. We evaluate SEVDF on the Juliet Test Suite (thirteen CWE categories) and a curated real-world dataset of 71 vulnerabilities across 9 projects. SEVDF consistently outperforms the default CodeQL rules, CodeQL rules with all unnecessary constraints removed, and three open-source detectors, which are Infer, Cppcheck and CodeChecker. SEVDF is able to achieve 100% precision on several CWEs while maintaining or improving recall on Juliet benchmark. Moreover, our segment-based design reduces the analysis workload for LLMs by 90.6% compared to direct-path prompting through Logic Unit deduplication, making SEVDF cost-effective for large-scale deployment. Finally, SEVDF uncovered and reported 29 0-day vulnerabilities (12 confirmed to date), including 3 CVEs in VirtualBox, demonstrating practical value.
@article{paperbot3797,
title = {Reframing Paths as Logic: Semantic Segmentation for Vulnerability Detection},
author = {Zong Cao and Yuqiang Sun and Zhengzi Xu and Kaixuan Li and Yeqi Fu and Yiran Zhang and Ziqiao Kong and Yang Liu},
journal = {Proceedings of the ACM on Programming Languages},
volume = {10},
number = {OOPSLA1},
year = {2026},
doi = {10.1145/3798272}
}