一句话：提出 BugLens，用结构化 LLM 推理对静态分析告警进行后精化，将 Linux 内核污点式缺陷检测精度从 0.10 提升至 0.72。
静态分析对漏洞检测至关重要，但在 Linux 内核等大型代码库中面临精度与可扩展性权衡：简化的漏洞建模和路径/数据约束过近似导致大量误报；LLM 虽具代码理解潜力，直接用于程序分析仍不可靠。本文提出 BugLens，一个后精化框架，通过引导 LLM 执行结构化推理，从源代码评估安全影响并验证约束，以提高静态分析检测精度。在 Linux 内核污点式缺陷上评估，BugLens 将精度从 0.10 提升至 0.72（约 7 倍），大幅减少误报，并发现四个此前未报告的漏洞。结果表明，结构化、全自动的 LLM 工作流能有效补充并增强传统静态分析。
Static analysis plays a crucial role in software vulnerability detection, yet faces a persistent precision-scalability trade-off. In large codebases like the Linux kernel, traditional static analysis tools often generate excessive false positives due to simplified vulnerability modeling and over-approximation of path and data constraints. While Large Language Models (LLMs) demonstrate promising code understanding capabilities, their direct application to program analysis remains unreliable due to inherent reasoning limitations.We introduce BugLens, a post-refinement framework that significantly enhances static analysis precision for bug detection. BugLens guides LLMs through structured reasoning steps to assess security impact and validate constraints from the source code. When evaluated on Linux kernel’s taint-style bugs detected by static analysis tools, BugLens improves precision approximately 7-fold (from 0.10 to 0.72), substantially reducing false positives while uncovering four previously unreported vulnerabilities. Our results demonstrate that a well-structured, fully-automated LLM-based workflow can effectively complement and enhance traditional static analysis techniques.
DOI 原文 ·
@inproceedings{paperbot9395,
title = {Towards More Accurate Static Analysis for Taint-Style Bug Detection in Linux Kernel},
author = {Haonan Li and Hang Zhang and Kexin Pei and Zhiyun Qian},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00039}
}