The significant increase in software production, driven by the acceleration of development cycles over the past two decades, has led to a steady rise in software vulnerabilities, as shown by statistics published yearly by the CVE program. The automation of the source code vulnerability detection (CVD) process has thus become essential, and several methods have been proposed ranging from the well established program analysis techniques to the more recent AI-based methods. Our research investigates Large Language Models (LLMs), which are considered among the most performant AI models to date, for the CVD task. The objective is to study their performance and apply different state-of-the-art techniques to enhance their effectiveness for this task. We explore various fine-tuning and prompt engineering settings. We particularly suggest one novel approach for fine-tuning LLMs which we call Double Fine-tuning, and also test the understudied Test-Time fine-tuning approach. We leverage the recent open-source Llama-3.1 8B, with source code samples extracted from BigVul and PrimeVul datasets. Our conclusions highlight the importance of fine-tuning to resolve the task, the performance of Double tuning, as well as the potential of Llama models for CVD. Though prompting proved ineffective, Retrieval augmented generation (RAG) performed relatively well as an example selection technique. Overall, some of our research questions have been answered, and many are still on hold, which leaves us many future work perspectives. Code repository is available here: https://github.com/DynaSoumhaneOuchebara/Llama-based-vulnerability-detection.
Evaluating LLaMA 3.2 for Software Vulnerability Detection
Research Group on Intelligent Engineering and Computing for Advanced Innovation and Development (GECAD), School of Engineering of the Polytechnic of Porto（波尔图理工学院工程学院）；INESC TEC/Polytechnic of Porto - School of Engineering（INESC TEC/波尔图理工学院工程学院）
LLM4Vuln: A Unified Evaluation Framework for Decoupling and Enhancing LLMs' Vulnerability Reasoning
Nanyang Technological University, Singapore（南洋理工大学）；The Hong Kong University of Science（香港科学与技术大学）；MetaTrust Labs（MetaTrust实验室）；Singapore Management University, Singapore（新加坡管理学院）；University of Oregon, Eugene, OR, USA（俄勒冈大学）
Let the Trial Begin: A Mock-Court Approach to Vulnerability Detection using LLM-Based Agents
School of Computing and Information Systems, Singapore Management University, Singapore（计算与信息系统学院，新加坡管理大学，新加坡）；School of Computer Science, University of Sydney, Australia（计算机科学学院，悉尼大学，澳大利亚）
Advanced Topic Modeling Techniques for Categorizing Software Vulnerabilities
Department of Computer Science & Engineering, Amrita School of Computing, Bengaluru, Amrita Vishwa Vidyapeetham, India（计算机科学与工程系，Amrita计算学院，班加罗尔，Amrita世界大学，印度）
Revealing the Intrinsic Ethical Vulnerability of Aligned Large Language Models
Department of Electrical and Electronic Engineering（电子与电气工程系）；The Hong Kong Polytechnic University（香港理工大学）；School of Electronics and Information（电子与信息学院）；Northwestern Polytechnical University（西北工业大学）
Two Timin': Repairing Smart Contracts With A Two-Layered Approach
Westborough High School（韦斯特伯勒高中）；Sunset High School（森塞特高中）；Granite Bay High School（格拉尼特贝高中）；Lakeside School（湖滨学校）；Bellarmine College Preparatory（贝拉明大学预科学校）；Robbinsville High School（罗宾斯维尔高中）；University of Illinois（伊利诺伊大学）
LLM-HyPZ: Hardware Vulnerability Discovery using an LLM-Assisted Hybrid Platform for Zero-Shot Knowledge Extraction and Refinement
Department of Electrical and Computer Engineering, University of Arizona, Tucson, AZ, USA（电气与计算机工程系，亚利桑那大学）；Department of Systems and Industrial Engineering, University of Arizona, Tucson, AZ, USA（系统与工业工程系，亚利桑那大学）；College of Information Science, University of Arizona, Tucson, AZ, USA（信息科学学院，亚利桑那大学）；School of Electrical Engineering and Computer Science, University of North Dakota, Grand Forks, ND, USA（电气工程与计算机科学学院，北达科他大学）；Department of Computer Science, University of California Davis, CA, USA（计算机科学系，加州大学戴维斯分校）
A Systematic Literature Review on Detecting Software Vulnerabilities with Large Language Models
Esslingen University（埃斯林根大学）；Institute for Intelligent Systems, Esslingen University（智能系统研究所，埃斯林根大学）；Chair of Communication Networks, University of Tübingen（通信网络教研室，图宾根大学）
Less Data, More Security: Advancing Cybersecurity LLMs Specialization via Resource-Efficient Domain-Adaptive Continuous Pre-training with Minimal Tokens
SSH Communications Security（SSH通讯安全公司）；KTH Royal Institute of Technology（皇家理工学院）；Aalto University（阿尔托大学）
Mastermind: Strategy-grounded Learning for Repository-Scale Vulnerability Reproduction
National University of Singapore（新加坡国立大学）；Nanyang Technological University（南洋理工大学）；The Hong Kong University of Science and Technology (Guangzhou)（香港科技大学（广州））
