LLM用于JavaScript代码漏洞识别的研究
Exploring Automated Vulnerability Identification in JavaScript Code Using Large Language Models
朋友，有个研究挺有意思，用大模型（比如Gemini 1.5 Flash）来识别JavaScript代码里的漏洞，准确率能到60%，比传统工具强多了。
这篇论文研究了用大型语言模型（LLM）来识别JavaScript代码中的漏洞。他们测试了Gemini 1.5 Flash、GPT-4o Mini和DeepSeek-R1-Distill-Llama-8B三个模型，在零样本、链式思维和少量样本提示策略下，对包含5类常见漏洞（如SQL注入、跨站脚本）的1125个代码片段进行了评估。结果显示，经过微调的Gemini 1.5 Flash模型在片段级别漏洞识别上的准确率达到60%，显著优于传统的规则分析器。链式思维提示对GPT-4o Mini这类推理能力强的模型有帮助，少量样本提示对跨站脚本这类多态性漏洞有效，SQL注入这类结构化漏洞的准确率最高可达84%。
Exploring Automated Vulnerability Identification in JavaScript Code Using Large Language Models
JavaScript powers approximately 98.8% of all websites, making vulnerabilities in its code a significant security risk, yet existing detection approaches such as Static Application Security Testing (SAST) tools often fail to identify many real-world vulnerabilities when applied to isolated code snippets. This paper presents an empirical study of Large Language Model (LLM)-based vulnerability identification for JavaScript programs, evaluating three LLM families (Gemini 1.5 Flash, GPT-4o Mini, DeepSeek-R1-Distill-Llama-8B) across multiple prompting strategies (zero-shot, chain-of-thought, few-shot) and fine-tuning approaches on a dataset of 1,125 JavaScript code snippets spanning five Common Weakness Enumeration (CWE) categories: Injection (CWE-74), OS Command Injection (CWE-78), Cross-Site Scripting (CWE-79), SQL Injection (CWE-89), and Uncontrolled Resource Consumption (CWE-400). Our experiments show that LLMs substantially outperform traditional SAST tools on snippet-level vulnerability identification, with a fine-tuned Gemini 1.5 Flash model achieving 60% detection accuracy compared to near-zero performance from rule-based analyzers. We find that fine-tuning improves accuracy from 29% to 60%, Chain-of-Thought prompting benefits reasoning-capable models such as GPT-4o Mini, few-shot prompting is effective for polymorphic vulnerabilities such as Cross-Site Scripting, and performance varies across vulnerability categories, reaching up to 84% accuracy for structured vulnerabilities such as SQL Injection. These results indicate that LLMs provide a practical approach for automated vulnerability identification in JavaScript code, particularly when combined with task-aligned supervision, though they should complement rather than replace existing security analysis workflows due to limited recall and uneven performance across vulnerability types.
