The cybersecurity landscape has grown increasingly complex, with traditional Static Application Security Testing (SAST) tools often unable to capture emerging vulnerabilities due to their reliance on rule-based matching. Large Language Models (LLMs) offer promising code analysis capabilities, yet static training data and privacy concerns limit their effectiveness. To address these gaps, we propose LSAST, a novel integration of LLMs with SAST scanners, enhancing vulnerability detection. LSAST utilizes a locally hosted LLM with a dynamic knowledge retrieval system, ensuring up-to-date vulnerability insights while safeguarding data privacy. Our approach sets a new standard for static vulnerability analysis, bridging the capabilities of traditional scanners and advanced AI-driven methods. Evaluation results show that integrating SAST results into LLM analysis significantly enhances detection accuracy, capturing vulnerabilities that conventional methods miss.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

LSAST: Enhancing Cybersecurity Through LLM-Supported Static Application Security Testing

  • Mete Keltek,
  • Rong Hu,
  • Mohammadreza Fani Sani,
  • Ziyue Li

摘要

The cybersecurity landscape has grown increasingly complex, with traditional Static Application Security Testing (SAST) tools often unable to capture emerging vulnerabilities due to their reliance on rule-based matching. Large Language Models (LLMs) offer promising code analysis capabilities, yet static training data and privacy concerns limit their effectiveness. To address these gaps, we propose LSAST, a novel integration of LLMs with SAST scanners, enhancing vulnerability detection. LSAST utilizes a locally hosted LLM with a dynamic knowledge retrieval system, ensuring up-to-date vulnerability insights while safeguarding data privacy. Our approach sets a new standard for static vulnerability analysis, bridging the capabilities of traditional scanners and advanced AI-driven methods. Evaluation results show that integrating SAST results into LLM analysis significantly enhances detection accuracy, capturing vulnerabilities that conventional methods miss.