超越静态模式匹配？在大语言模型时代重新思考自动密码API误用检测
Beyond Static Pattern Matching? Rethinking Automatic Cryptographic API Misuse Detection in the Era of LLMs
AI总结：
本文探讨了在大语言模型时代利用LLM进行密码API误用检测的新方法，通过改进检测策略和验证技术，显著提升了检测准确率，并发现新的漏洞。
摘要：
尽管自动化检测密码API误用已取得显著进展，但其精度在复杂目标上下降，因为依赖手动定义的模式。大语言模型（LLMs）提供了一种上下文感知的理解来解决这一不足，但其随机性和幻觉问题给精确的安全分析带来了挑战。本文首次系统研究了LLM在密码API误用检测中的应用。我们的发现值得注意：直接应用LLM的不稳定性导致初始报告中有一半是假阳性。尽管如此，通过将检测范围与现实场景对齐并采用新的代码和分析验证技术，LLM基于的检测可靠性可显著提高，达到近90%的检测召回率。这一改进明显优于传统方法，并在现有基准中发现了以前未知的漏洞。然而，我们识别出重复的失败模式，揭示了当前LLM的盲点。利用这些发现，我们部署了一个基于LLM的检测系统，在开源Java和Python仓库中发现了63个新漏洞（47个已确认，7个已修复），包括Apache等知名项目。
英文摘要：
While the automated detection of cryptographic API misuses has progressed significantly, its precision diminishes for intricate targets due to the reliance on manually defined patterns. Large Language Models (LLMs) offer a promising context-aware understanding to address this shortcoming, yet the stochastic nature and the hallucination issue pose challenges to their applications in precise security analysis. This paper presents the first systematic study to explore LLMs' application in cryptographic API misuse detection. Our findings are noteworthy: The instability of directly applying LLMs results in over half of the initial reports being false positives. Despite this, the reliability of LLM-based detection could be significantly enhanced by aligning detection scopes with realistic scenarios and employing a novel code and analysis validation technique, achieving a nearly 90% detection recall. This improvement substantially surpasses traditional methods and leads to the discovery of previously unknown vulnerabilities in established benchmarks. Nevertheless, we identify recurring failure patterns that illustrate current LLMs' blind spots. Leveraging these findings, we deploy an LLM-based detection system and uncover 63 new vulnerabilities (47 confirmed, 7 already fixed) in open-source Java and Python repositories, including prominent projects like Apache.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
