利用精确且完整的代码上下文指导LLM进行自动误报缓解
Utilizing Precise and Complete Code Context to Guide LLM in Automatic False Positive Mitigation
AI总结：
提出LLM4FPM框架，通过eCPG-Slicer提取精确行级代码上下文和FARF算法线性识别相关文件，指导轻量级LLM实现高效低成本的自动误报缓解，在Juliet和D2A数据集上表现优异。
摘要：
静态应用安全测试（SAST）工具对软件质量至关重要，能在开发早期识别潜在代码问题。然而，它们常产生需要人工审查的误警告，从而拖慢开发进度。因此，自动化误报缓解（FPM）至关重要。大型语言模型（LLMs）的出现凭借其在自然语言和代码理解方面的强大能力，为FPM提供了有前景的途径。然而，当前基于LLM的FPM方法面临两大主要局限：1. 提取的与警告相关的代码片段过于宽泛，且充斥着无关的控制/数据流，降低了精度；2. 缺失关键代码上下文，导致不完整的表示，可能误导LLM并造成不准确的评估。为了克服这些局限，我们提出了LLM4FPM，一个轻量级且高效的误报缓解框架。它包含eCPG-Slicer，该工具构建扩展代码属性图（eCPG）来提取针对警告的精确行级代码上下文。此外，集成的FARF算法构建文件引用图，以线性时间识别所有与警告相关的文件。这使得eCPG-Slicer无需依赖昂贵的全程序分析即可获取丰富的上下文信息。LLM4FPM在Juliet数据集上优于现有方法（在各种通用缺陷枚举中F1 > 99%），并将D2A数据集上的标签准确率提升至86%。通过利用轻量级开源LLM，LLM4FPM在Juliet上每次运行可显著节省高达2758美元的检查成本（每条警告0.384美元），平均检查时间为每条警告4.7秒。此外，在流行的C/C++项目上的实际测试证明了其实用性。
英文摘要：
Static Application Security Testing (SAST) tools are critical to software quality, identifying potential code issues early in development. However, they often produce false positive warnings that require manual review, slowing down development. Thus, automating false positive mitigation (FPM) is essential. The advent of Large Language Models (LLMs), with their strong abilities in natural language and code understanding, offers promising avenues for FPM. Yet current LLM-based FPM method faces two major limitations: 1. The warning-related code snippets extracted are overly broad and cluttered with irrelevant control/data flows, reducing precision; 2. Critical code contexts are missing, leading to incomplete representations that can mislead LLMs and cause inaccurate assessments. To overcome these limitations, we propose LLM4FPM , a lightweight and efficient false positive mitigation framework. It features eCPG-Slicer, which builds an extended code property graph (eCPG) to extract precise line-level code contexts for warnings. Furthermore, the integrated FARF algorithm builds a file reference graph to identify all files that are relevant to warnings in linear time. This enables eCPG-Slicer to obtain rich contextual information without resorting to expensive whole-program analysis. LLM4FPM outperforms the existing method on the Juliet dataset (F1 > 99% across various Common Weakness Enumerations) and improves label accuracy on the D2A dataset to 86%. By leveraging a lightweight open-source LLM, LLM4FPM can significantly save inspection costs up to \$2758 per run (\$0.384 per warning) on Juliet with an average inspection time of 4.7s per warning. Moreover, real-world tests on popular C/C++ projects demonstrate its practicality.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
