关于指令微调本地LLM在识别软件漏洞中的有效性
On the Effectiveness of Instruction-Tuning Local LLMs for Identifying Software Vulnerabilities
AI总结：
本文提出通过指令微调本地LLM来提升软件漏洞识别效果，替代依赖API的大型模型，实现更高效、安全的漏洞管理。
摘要：
大型语言模型（LLMs）在自动化软件漏洞分析中显示出显著的潜力，这是一个关键任务，因为现代软件系统的安全失败影响深远。然而，目前使用LLMs自动化漏洞分析的方法大多依赖于使用基于在线API的LLM服务，要求用户在开发过程中披露源代码。此外，它们大多将任务框定为二元分类（漏洞或无漏洞），限制了潜在的实际实用性。本文通过将问题重新表述为软件漏洞识别（SVI）来解决这些限制，其中LLMs被要求输出常见的弱点枚举（CWE）ID中的弱点类型，而不是仅仅指示漏洞的存在或不存在。我们还通过证明指令微调较小的本地可部署LLM可以实现更优的识别性能，来解决对大型API-based LLM的依赖。在我们的分析中，指令微调本地LLM在整体性能和成本权衡方面优于在线API-based LLMs。我们的发现表明，指令微调的本地模型在利用LLMs进行实际漏洞管理流程方面更加有效、安全和实用。
英文摘要：
Large Language Models (LLMs) show significant promise in automating software vulnerability analysis, a critical task given the impact of security failure of modern software systems. However, current approaches in using LLMs to automate vulnerability analysis mostly rely on using online API-based LLM services, requiring the user to disclose the source code in development. Moreover, they predominantly frame the task as a binary classification(vulnerable or not vulnerable), limiting potential practical utility. This paper addresses these limitations by reformulating the problem as Software Vulnerability Identification (SVI), where LLMs are asked to output the type of weakness in Common Weakness Enumeration (CWE) IDs rather than simply indicating the presence or absence of a vulnerability. We also tackle the reliance on large, API-based LLMs by demonstrating that instruction-tuning smaller, locally deployable LLMs can achieve superior identification performance. In our analysis, instruct-tuning a local LLM showed better overall performance and cost trade-off than online API-based LLMs. Our findings indicate that instruct-tuned local models represent a more effective, secure, and practical approach for leveraging LLMs in real-world vulnerability management workflows.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
