一句话：提出可解释性约定与工具 SECGen，将静态分析器输出转化为开发者友好的漏洞报告，并经用户研究验证其提升修复效率。
软件安全长期存在一个缺口：静态分析工具能检测漏洞，但输出过于技术化，多数开发者难以理解，导致修复依赖安全专家、形成瓶颈并累积安全债务。本文提出一种可解释性约定和模块化工作流，将静态分析器的原始输出转化为清晰、可操作的漏洞报告。工具 SECGen 自动解析分析器输出，按约定重构为开发者友好的报告，并通过自动验证确保合规。作者用 25 名开发者进行用户研究，与当前最优静态分析器输出对比。结果表明，使用可解释报告的开发者能更有效地发现、理解和修复漏洞，耗时仅为传统报告的 67%，且修复更正确；参与者尤其偏好结构化报告、清晰的漏洞描述和可操作的修复建议。
Software security faces a persistent gap: static analysis tools detect vulnerabilities effectively, but their technical outputs remain inaccessible to most developers. This leads to mounting security debt, as organizations must rely on security specialists for remediation, creating bottlenecks that delay fixes. This paper proposes an interpretability convention and a modular workflow that transforms raw static analyzer outputs into clear, actionable vulnerability reports for all developers, not just security experts. Our tool, SECGen, automates the workflow by parsing static analyzer outputs and restructuring them into clear, developer-friendly reports based on our convention, and enforcing compliance through automated validation. We validated our approach through a user study with 25 developers, comparing our interpretable reports to other state-of-the-art static analyzer outputs. The results suggest that developers using interpretable reports detect, understand and fix vulnerabilities more effectively, requiring only 67% of the time typically spent with traditional reports while writing more correct fixes. Key reasons for this include participants’ preference for structured reports, with clear vulnerability descriptions and actionable fix suggestions.
DOI 原文 ·
@inproceedings{paperbot9304,
title = {Interpretable Vulnerability Detection Reports},
author = {Claudia Mamede and José Campos and Claire Le Goues and Rui Abreu},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00168}
}