QRS：一种用于自主漏洞发现的神经符号三元组规则生成器
QRS: A Rule-Synthesizing Neuro-Symbolic Triad for Autonomous Vulnerability Discovery
AI总结：
QRS通过神经符号方法生成代码查询，发现超出预定义模式的漏洞，显著降低假阳性，并在低开销下发现高严重性漏洞。
摘要：
静态应用程序安全测试（SAST）工具是现代DevSecOps流水线中的重要组成部分，但像CodeQL、Semgrep和SonarQube这样的工具仍然受到根本限制：它们需要专家编写的查询，会产生过多的假阳性结果，并且只能检测预定义的漏洞模式。最近的研究尝试通过大型语言模型（LLMs）增强SAST，但这些方法通常使用LLMs来筛选现有工具的输出，而不是直接推理解漏洞语义。我们引入了QRS（查询、审查、净化），一种神经符号框架，颠覆了这一范式。而不是从静态规则中过滤结果，QRS使用三个自主代理，根据结构化的模式定义和少量示例生成CodeQL查询，然后通过语义推理和自动化利用合成来验证发现。这种架构使QRS能够发现超出预定义模式的漏洞类别，同时显著减少假阳性结果。我们对完整的Python包进行评估，而不是孤立的代码片段。在20个历史上流行的PyPI库中的CVE中，QRS实现了90.6%的检测准确率。应用于最流行的100个PyPI包时，QRS发现了39个中等至高严重性漏洞，其中5个被分配了新的CVE，5个获得了文档更新，而其余29个由同时期的研究人员独立发现，验证了这些发现的严重性和可发现性。QRS在低时间开销和可控的token成本下实现了这一目标，证明了LLM驱动的查询生成和代码审查可以补充手动编写的规则集，并发现逃避现有行业工具的漏洞模式。
英文摘要：
Static Application Security Testing (SAST) tools are integral to DevSecOps pipelines, yet tools like CodeQL, Semgrep, and SonarQube remain constrained: they require expert-crafted queries, generate excessive false positives, and detect only predefined patterns. Recent work augments SAST with Large Language Models (LLMs), but typically requires fine-tuning or uses LLMs only to triage outputs rather than reason directly about vulnerability semantics. We introduce QRS (Query, Review, Sanitize), a neuro-symbolic framework that inverts this paradigm by relocating the LLM to the pipeline's generative core. Rather than filtering static-rule results, QRS employs three autonomous agents that generate CodeQL queries from a structured schema and few-shot examples, then validate findings through semantic reasoning and minimal proof-of-concept exploits, manually verified. This lets QRS surface vulnerability classes beyond predefined patterns while reducing the code volume needing audit. We evaluate QRS on complete packages rather than isolated snippets, across Python and Java ecosystems and three datasets. On the 100 most-downloaded PyPI packages, QRS reaches up to 94.06\% verdict accuracy and surfaces 41 medium-to-high vulnerabilities: 8 received new CVEs, 4 were acknowledged via documentation updates, and the remaining 29 were previously published CVEs rediscovered from source alone. To evaluate language portability and enable direct comparison with prior work, we extend QRS to Java and evaluate it on CWE-Bench-Java, detecting 58/90 in-scope CVEs (64.44\%) at 87.60\% accuracy, 98.79\% recall, and 0.857 F1 (0.794 macro-averaged) in one scan. QRS achieves these results with low time overhead and manageable token costs while handling large codebases, showing that LLM-driven query synthesis and review can complement curated rule sets and surface patterns that evade existing industry tools.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
