Empowering Large Language Models with Static Analysis for Effective Vulnerability Detection

Abstract

Web applications are pervasive and security-critical, making accurate vulnerability detection essential for protecting sensitive data and service integrity. Although static analysis tools (SATs) are widely used for vulnerability detection, they often suffer from high false positive (FP) rates and limited adaptability to evolving code patterns and vulnerability variants. Recently, Large Language Models (LLMs) have emerged as a promising alternative; however, when used in isolation, they often overestimate vulnerabilities, resulting in higher FP rates. In this paper, we propose a Hybrid Framework that leverages SAT-extracted data flows and vulnerability metadata to decompose vulnerability detection into smaller, well-scoped reasoning steps for LLMs, thereby improving detection and reducing FPs. Rather than using LLMs to guide or replace static analysis, the proposed framework relies on verified static analysis outputs to bound and refine LLM-based vulnerability reasoning. We evaluate the framework’s effectiveness against standalone KAVE SAT and LLMs with different prompt strategies for SQL injection and XSS detection, using both a controlled benchmark and 15 real-world web applications.The results show that the best hybrid solution is composed of GPT-4o LLM tuned with the role-based prompt strategy empowered by KAVE output on code properties and data flow. The solution discovered 16 zero-day vulnerabilities, and enhances detection, where it reduces the FP rate from 65% to under 16% on average over standalone LLM detection. In real-world applications, it improves the F1-score by 6–12% over the standalone LLM and improves recall by 31% for XSS, while offering a better precision–recall trade-off than the standalone SAT. These results illustrate the framework’s practical applicability and indicate that it constitutes a promising direction for advancing vulnerability detection.