VulInstruct: 通过安全规范指导LLMs进行漏洞检测的根因推理
VulInstruct: Teaching LLMs Root-Cause Reasoning for Vulnerability Detection via Security Specifications
AI总结：
VulInstruct通过从历史漏洞中系统提取安全规范，指导LLMs进行漏洞检测，提升了漏洞识别的准确性和推理能力，实现了更高的F1分数和召回率。
摘要：
大型语言模型（LLMs）在代码理解任务中取得了显著进展，但其在漏洞检测中的表现有限，难以区分漏洞代码与修复后的代码。我们认为LLMs缺乏对安全规范的理解——代码应如何行为以保持安全的期望。当代码行为与这些期望不符时，就可能成为潜在漏洞。然而，此类知识在训练数据中很少显式呈现，使模型无法推理安全缺陷。我们提出VulInstruct，一种规范引导的方法，系统地从历史漏洞中提取安全规范以检测新漏洞。VulInstruct从两个角度构建规范知识库：(i) 高质量补丁中的通用规范，捕捉基本安全行为；(ii) 特定领域中的重复违规规范，相关于目标代码的特定仓库。VulInstruct检索相关的历史案例和规范，使LLMs能够推理预期的安全行为，而不是依赖表面模式。我们在严格标准下评估VulInstruct，要求预测正确和推理有效。在PrimeVul上，VulInstruct在F1分数（32.7%提升）和召回率（50.8%提升）上优于基线，同时唯一检测到24.3%的漏洞——比任何基线多2.4倍。在成对评估中，VulInstruct实现了32.3%的相对提升。VulInstruct还发现了一个之前未知的高严重性漏洞（CVE-2025-56538）在生产代码中，展示了实际价值用于现实世界漏洞发现。所有代码和补充材料可在https://github.com/zhuhaopku/VulInstruct-temp获取。
英文摘要：
Large language models (LLMs) have achieved remarkable progress in code understanding tasks. However, they demonstrate limited performance in vulnerability detection and struggle to distinguish vulnerable code from patched code. We argue that LLMs lack understanding of security specifications -- the expectations about how code should behave to remain safe. When code behavior differs from these expectations, it becomes a potential vulnerability. However, such knowledge is rarely explicit in training data, leaving models unable to reason about security flaws. We propose VulInstruct, a specification-guided approach that systematically extracts security specifications from historical vulnerabilities to detect new ones. VulInstruct constructs a specification knowledge base from two perspectives: (i) General specifications from high-quality patches across projects, capturing fundamental safe behaviors; and (ii) Domain-specific specifications from repeated violations in particular repositories relevant to the target code. VulInstruct retrieves relevant past cases and specifications, enabling LLMs to reason about expected safe behaviors rather than relying on surface patterns. We evaluate VulInstruct under strict criteria requiring both correct predictions and valid reasoning. On PrimeVul, VulInstruct achieves 45.0% F1-score (32.7% improvement) and 37.7% recall (50.8% improvement) compared to baselines, while uniquely detecting 24.3% of vulnerabilities -- 2.4x more than any baseline. In pair-wise evaluation, VulInstruct achieves 32.3% relative improvement. VulInstruct also discovered a previously unknown high-severity vulnerability (CVE-2025-56538) in production code, demonstrating practical value for real-world vulnerability discovery. All code and supplementary materials are available at https://github.com/zhuhaopku/VulInstruct-temp.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
