SETYPE is presented, a semantics-aware type system that can be derived directly from source code based solely on the meanings of symbols and expressions in natural language that achieves 87% detection precision and 88% detection accuracy on real-world applications.
Abstract
Vulnerability detection via static analysis traditionally relies on security experts encoding insecure coding patterns into algorithmic rules. However, this approach often focuses on syntactic patterns and overlooks deeper semantic information in the code, such as the meanings of variable and function names. As software systems grow more complex, modeling vulnerabilities using only syntactic rules becomes increasingly challenging. In this paper, we propose a semantics-aware approach to detecting software vulnerabilities. We present SETYPE, a semantics-aware type system that can be derived directly from source code based solely on the meanings of symbols and expressions in natural language. In the SETYPE type system, both type inference and checking are performed by Large Language Models (LLMs), and a failed type check indicates a potential vulnerability. We prototype PYSETYPE to demonstrate the feasibility of SETYPE for detecting vulnerabilities in Python web applications. Our evaluation on real-world applications achieves 87% detection precision and 88% detection accuracy. Using PYSETYPE, we identified 15 potential zero-day vulnerabilities, nine of which were confirmed by developers.
Experimental results show that AST-based structural features substantially improve recall compared with the TF-IDF baseline, while the combined TF-IDF and AST representation maintains this improved performance.
Vani Pasupula, M. N. V. Manikanth, Nagaraju Vassey· International Journal of Cre...· 0 citations
Large Language Models (LLMs) are increasingly used for software vulnerability detection, but their performance depends on how source code is represented in the input. Most prompting approaches use source code in its original form, while some works propose the use of structured representations. Abstract Syntax Trees (ASTs) are one of the most popular approaches, but AST verbosity increases input size relative to source code, making them hard to fit within some LLMs context windows. This paper investigates Behavior Trees (BTs) as an alternative intermediate representation for LLM-based vulnerability detection. BTs encode control flow, conditions, and executable actions more compactly than ASTs, making them a natural candidate when token count is a constraint. First, we propose a preprocessing stage that parses Java source code into ASTs and then converts them into BT representations. We then compare vulnerability detection performance across 460 Java samples from the Juliet Java test suite, using three input representations: raw source code, AST, and BT. All experiments use a single quantized local LLM, Mistral Small 3.2 24B (Q4_K_M). Our results show that using BT representations improves recall on short code samples, while raw source code achieves higher precision. On longer samples, BTs improve overall performance over the original representation and fit within the context window, whereas many ASTs exceed the context limit. These findings suggest that BTs can provide a compact and useful structured representation for vulnerability detection with quantized, locally deployable LLMs.
Security vulnerabilities in software systems remain a major concern in modern computing,
especially as applications grow in complexity and are increasingly integrated into critical
infrastructures. Traditional vulnerability detection methods such as static code analysis tools and
manual inspection face limitations in accuracy, scalability, and privacy preservation, since they
often rely on cloud-based solutions that expose sensitive source code. This paper presents an on
premise Artificial Intelligence (AI)-based model for vulnerability detection in source code,
designed to ensure there is efficiency in identifying potential weaknesses. The system employs a
fine-tuned CodeBERT model, which leverages transformer-based natural language processing
techniques to learn semantic patterns in source code. By deploying the model locally within a
Dockerized environment, the solution ensures that source code remains entirely under
organizational control, eliminating reliance on external servers. The methodology integrates real
time scanning for multiple programming languages (Python, Java, and JavaScript), a web-based
upload interface, and a core detection algorithm capable of classifying vulnerabilities based on
learned patterns. Evaluation results demonstrate strong detection performance, with an average
score of 92% for accuracy, precision, recall and F1-score respectively. The findings highlight the
potential of on-premise AI-based systems to revolutionize vulnerability detection by combining
accuracy and scalability.
D. Sako· International Journal of Com...· 0 citations
CWEEP can identify the exact location in the RTL where the potential vulnerability resides and supports automatic code repair suggestions when applicable, so it can be used in the early stages of RTL development while properties are still under construction.
This paper investigates automated fault localization for verification-aware languages by comparing two paradigms: state-based and counterexample-based localization, and shows that counterexample-based approaches substantially outperform state-based localization in this setting.
Álvaro F. Silva, Isabel Amaral, João Pascoal Faria et al.· 0 citations
Assessing vulnerability detection tools for smart contracts requires datasets with known ground truth, yet such datasets are scarce and difficult to build by hand. We propose an approach that uses Large Language Models (LLMs) to automatically inject vulnerabilities into Solidity smart contracts, and demonstrate it in a case study targeting 49 vulnerability types from OpenSCV. Injected contracts are validated through a multi-step pipeline checking compilation, execution, business logic, and the presence of the intended vulnerability. Applied to real-world contracts from SmartBugs, LLMs generate nearly 1,000 candidate variants; after deduplication and validation, 32 confirmed vulnerable contracts spanning 25 vulnerability types survive (a 16.58% survival rate). Surviving contracts concentrate in structurally simpler targets and vulnerability types with localized syntactic patterns. We report practical challenges including LLMs'non-determinism and the difficulty of preserving contract semantics. We then use the validated contracts to assess three static analyzers, revealing complementary and incomplete coverage profiles. Results show that LLM-based vulnerability injection is feasible, while exposing key limitations in scalability and diversity.
Luca Migliaccio, Roberto Natella, N. Ivaki et al.· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
