一句话：通过多智能体协作，将基于 LLM 的漏洞检测从函数级扩展到仓库级，应对跨文件的过程间漏洞。
基于大语言模型的漏洞检测已在许多软件工程任务中展现效果，但受限于 LLM 的输入上下文长度，现有方法主要面向函数级、利用文件内上下文检测过程内漏洞，忽视了实践中更复杂的过程间漏洞检测场景。现实中开发者需要借助程序分析来检测仓库中跨文件、跨过程的漏洞，而这类场景往往存在来自多文件的冗余依赖，并需要调用多种静态分析工具。理想目标是从仓库中抽取与漏洞相关的信息，并为漏洞触发原因提供可能的解释，但该目标难以直接达成。为此，作者通过多智能体协作设计了三个工作来逼近仓库级漏洞检测这一目标。
Large Language Model (LLM)-based methods have proven to be effective for many software engineering domains, with a potential for substantial productivity effective for software vulnerability detection. However, due to the limitation of the length of input contexts of LLM, the existing LLM-based methods mainly focus on detecting function-level and leveraging the in-file context information for vulnerability detection (i.e., intra-procedural vulnerabilities), ignoring the more complex inter-procedural vulnerability detection scenarios in practice. For instance, in real-world scenarios, developers routinely engage with program analysis to detect vulnerabilities that span multiple cross-file information within repositories. Since complex processes tend to have redundancy dependencies from spanning multiple files in the repository level and invoking multiple static analysis tools, the ideal goal of vulnerability detection is to extract the vulnerability-related information from the repository and provide potential possible explanations for vulnerability triggers. However, such a goal is hard to achieve, and thus in this work, we design three works through multi-agent collaboration to approach the goal of repository-level vulnerability detection.
DOI 原文 ·
@inproceedings{paperbot8528,
title = {Collaboration to Repository-Level Vulnerability Detection},
author = {Xin-Cheng Wen},
booktitle = {ISSTA},
year = {2024},
doi = {10.1145/3650212.3685562}
}