QLPro: Automated Code Vulnerability Discovery via LLM and Static Code Analysis Integration

2025/06/30 by Hu, Junze, Jin, Xiangyu, Zeng, Yizhe +5
#Artificial Intelligence (cs.AI) #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Software Engineering (cs.SE)

paper · doi:10.48550/arxiv.2506.23644

Abstract

We introduce QLPro, a vulnerability detection framework that systematically integrates LLMs and static analysis tools to enable comprehensive vulnerability detection across entire open-source projects.We constructed a new dataset, JavaTest, comprising 10 open-source projects from GitHub with 62 confirmed vulnerabilities. CodeQL, a state-of-the-art static analysis tool, detected only 24 of these vulnerabilities while QLPro detected 41. Furthermore, QLPro discovered 6 previously unknown vulnerabilities, 2 of which have been confirmed as 0-days.

Related

• IRIS: LLM-Assisted Static Analysis for Detecting Security Vulnerabilities
• CASTLE: Benchmarking Dataset for Static Code Analyzers and LLMs towards CWE Detection
• Harnessing the Power of LLMs in Source Code Vulnerability Detection
• LProtector: An LLM-driven Vulnerability Detection System
• OpenAnt: LLM-Powered Vulnerability Discovery Through Code Decomposition, Adversarial Verification, and Dynamic Testing