Nuthan Munaiah, Andrew Meneely
In this report, we describe the review protocol that will guide the systematic review of the literature in metrics-based discovery of vulnerabilities. The protocol have been developed in adherence with the guidelines for performing Systematic Literature Reviews in Software Engineering prescribed by Kitchenham and Charters.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
继续探索
LLM-based Vulnerability Discovery through the Lens of Code Metrics
该研究通过代码度量视角分析LLMs漏洞发现停滞的原因，发现仅用代码度量训练的分类器即可达到与最先进LLMs相当的性能，并揭示LLMs预测与代码度量间存在强相关及因果效应，据此提出改进研究方向。
Discovery of Timeline and Crowd Reaction of Software Vulnerability Disclosures
本文通过手动调查312个CVE，研究了漏洞披露时软件供应商和开发者社区的真实实践（群体反应），发现主要趋势是在公告前提供修复，且群体反应对漏洞严重程度不敏感，Oracle社区表现最为活跃。
QLPro: Automated Code Vulnerability Discovery via LLM and Static Code Analysis Integration
QLPro框架通过集成LLM与静态分析工具提升开源项目漏洞检测能力，在JavaTest数据集上比CodeQL多检出17个已知漏洞，并新发现6个未知漏洞（含2个0-day）。
FuzzingBrain V2: A Multi-Agent LLM System for Automated Vulnerability Discovery and Reproduction
本文提出FuzzingBrain V2，通过多智能体系统解决LLM在漏洞检测中的三大挑战：自动化分析、精准定位与复杂依赖推理，实现了90%的检测率并发现29个零日漏洞。
Directed Symbolic Execution for Vulnerability Discovery: An LLM-Guided Approach in KLEE
研究针对符号执行的路径爆炸问题，提出基于KLEE的KLEECopilot方法，用大语言模型引导定向符号执行，标记潜在漏洞代码、指导路径优先级并集成循环退出优先级，相比基线提升显著，各组件对有效性有贡献。
Zer0n: An AI-Assisted Vulnerability Discovery and Blockchain-Backed Integrity Framework
Zer0n通过结合AI与区块链技术，实现高效漏洞检测与完整性保障，达到80%的准确率并保持低开销。
A fundamental challenge of software testing is the statistically well-grounded extrapolation from program behaviors observed during testing. For instance, a security researcher who has run the fuzzer for a week has currently no means (i) to estimate the total number of feasible program branches, given that only a fraction has been covered so far, (ii) to estimate the additional time required to cover 10% more branches, or (iii) to assess the residual risk that a vulnerability exists when no vulnerability has been discovered. Failing to discover a vulnerability, does not mean that none exists--…
SWE-Test: Benchmarking LLM Vulnerability Discovery via Input Prediction
SWE-Test通过输入预测任务，利用覆盖率引导模糊测试挖掘真实C/C++程序中的深层分支，将漏洞发现分解为三种模式，评估发现约束推断是主要瓶颈，最佳模型通过率仅55%。
Where Do the Tokens Go? Understanding and Reducing Costs in LLM Agents for Vulnerability Discovery
该研究针对LLM智能体漏洞发现中Token消耗高却难出成果的问题，通过分析200条CyberGym轨迹揭示瓶颈，提出AVRI接口，可降低Codex和OpenCode的Token消耗并保持性能。
Guiding Symbolic Execution with Static Analysis and LLMs for Vulnerability Discovery
SAILOR结合静态分析与LLM合成自动构建符号执行Harness，通过三个阶段发现内存安全漏洞，实验表明其在大规模代码库中显著提升漏洞检测效率。
Unsupervised Binary Code Translation with Application to Code Similarity Detection and Vulnerability Discovery
本文提出将神经机器翻译技术用于跨架构二进制代码翻译，实现低资源ISA到高资源ISA的转换，并通过UNSUPERBINTRANS模型在代码相似性检测和漏洞发现任务中取得高准确率。
LLM-based Vulnerability Discovery in Business Process Documentation
该研究将LLMs应用于MIRABELLE系统，通过实验测试多种LLMs在业务流程文档漏洞检测各阶段的性能，以实现从业务流程表示中识别业务逻辑漏洞。
Knowledge-Enhanced Agentic Vulnerability Repair
提出KeaRepair，一种基于智能体的自动化漏洞修复方法，通过提取历史漏洞知识并利用工具增强的智能体进行诊断，生成并迭代优化补丁，在55个C/C++漏洞上修复率达83.64%。
Predicting vulnerable source code helps to focus attention on those parts of the code that need to be examined with more scrutiny. Recent work proposed the use of function names as semantic cues that can be learned by a deep neural network (DNN) to aid in the hunt for vulnerability of functions. Combining identifier splitting, which splits each function name into its constituent words, with a novel frequency-based algorithm, we explore the extent to which the words that make up a function's name can predict potentially vulnerable functions. In contrast to *lightweight* predictions by a DNN tha…
EntailLLM: Verifying LLM-Generated Vulnerability Discovery Paths with Domain Knowledge via Logic Programming
EntailLLM通过逻辑编程结合领域知识验证LLM生成的漏洞发现路径，在三类CWE、四个LLM等多组实验中，将合并蕴含率从78%提升至98%，可端到端部署且无需逐设备调优。
Vulnerability discovery and exploits detection are two wide areas of study in software engineering. This preliminary work tries to combine existing methods with machine learning techniques to define a metric classification of vulnerable computer programs. First a feature set has been defined and later two models have been tested against real world vulnerabilities. A relation between the classifier choice and the features has also been outlined.
From Reviewers' Lens: Understanding Bug Bounty Report Invalid Reasons with LLMs
利用大语言模型和结构化评审知识，研究如何识别和解释漏洞赏金报告的无效原因，以提高报告质量和评审一致性。
SoK: A Literature and Engineering Review of Regular Expression Denial of Service (ReDoS)
本文对正则表达式拒绝服务（ReDoS）进行文献与工程综述，梳理现有检测、防御方法及引擎防御实现情况，指出文献缺乏真实系统攻击评估、主流引擎防御使威胁模型过时等问题，并明确未来评估新兴防御、支持引擎迁移等研究方向。
Refute-or-Promote: An Adversarial Stage-Gated Multi-Agent Review Methodology for High-Precision LLM-Assisted Defect Discovery
本文提出Refute-or-Promote方法，通过对抗性阶段门多智能体评审，提高LLM辅助缺陷发现的精度，通过多种技术过滤虚假正例，最终发现多个漏洞并推动标准制定。
扫码添加微信好友，提出您的宝贵建议 👇
💡 备注请填写：网站反馈
发表机构由 AI 从论文文本抽取，如发现错误，欢迎反馈修正建议。