{"id":"https://openalex.org/W4399331997","doi":"https://doi.org/10.1145/3655693.3655701","title":"Evaluating the Impact of Conventional Code Analysis Against Large Language Models in API Vulnerability Detection","display_name":"Evaluating the Impact of Conventional Code Analysis Against Large Language Models in API Vulnerability Detection","publication_year":2024,"publication_date":"2024-06-04","ids":{"openalex":"https://openalex.org/W4399331997","doi":"https://doi.org/10.1145/3655693.3655701"},"language":"en","primary_location":{"id":"doi:10.1145/3655693.3655701","doi":"https://doi.org/10.1145/3655693.3655701","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3655693.3655701","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3655693.3655701","source":{"id":"https://openalex.org/S7407088847","display_name":"European Interdisciplinary Cybersecurity Conference (EICC)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"European Interdisciplinary Cybersecurity Conference","raw_type":"proceedings-article"},"parent_works":[],"lineage":["https://openalex.org/W4399331997"],"child_works_count":0,"type":"conference-paper","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"bronze","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3655693.3655701","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5099014916","display_name":"Recep Y\u0131ld\u0131r\u0131m","orcid":"https://orcid.org/0000-0002-6653-3593","observed_orcids":["https://orcid.org/0000-0002-6653-3593"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Recep Y\u0131ld\u0131r\u0131m","raw_affiliation_strings":["T\u00fcrkiye Sigorta, Turkey"],"raw_orcid":"https://orcid.org/0000-0002-6653-3593","affiliations":[{"raw_affiliation_string":"T\u00fcrkiye Sigorta, Turkey","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5099014917","display_name":"Kerem Ayd\u0131n","orcid":"https://orcid.org/0009-0009-9206-1874","observed_orcids":["https://orcid.org/0009-0009-9206-1874"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Kerem Ayd\u0131n","raw_affiliation_strings":["T\u00fcrkiye Sigorta, Turkey"],"raw_orcid":"https://orcid.org/0009-0009-9206-1874","affiliations":[{"raw_affiliation_string":"T\u00fcrkiye Sigorta, Turkey","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5005365576","display_name":"Or\u00e7un \u00c7etin","orcid":"https://orcid.org/0000-0001-9670-0295","observed_orcids":["https://orcid.org/0000-0001-9670-0295"]},"institutions":[{"id":"https://openalex.org/I134235054","display_name":"Sabanc\u0131 \u00dcniversitesi","ror":"https://ror.org/049asqa32","country_code":"TR","type":"education","lineage":["https://openalex.org/I134235054"]}],"countries":["TR"],"is_corresponding":false,"raw_author_name":"Or\u00e7un \u00c7etin","raw_affiliation_strings":["Sabanc\u0131 University, Turkey"],"raw_orcid":"https://orcid.org/0000-0001-9670-0295","affiliations":[{"raw_affiliation_string":"Sabanc\u0131 University, Turkey","institution_ids":["https://openalex.org/I134235054"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":4.1537,"has_fulltext":true,"cited_by_count":18,"citation_normalized_percentile":{"value":0.95387658,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":88,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"57","last_page":"64"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9779999852180481,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9779999852180481,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.01119999960064888,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.007300000172108412,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/api-security","display_name":"API security","score":0.8080000281333923},{"id":"https://openalex.org/keywords/large-language-models","display_name":"large language models","score":0.9810000061988831},{"id":"https://openalex.org/keywords/static-code-analysis","display_name":"static code analysis","score":0.9610000252723694},{"id":"https://openalex.org/keywords/chatgpt-4","display_name":"ChatGPT-4","score":0.7950000166893005},{"id":"https://openalex.org/keywords/llama-2","display_name":"Llama 2","score":0.8709999918937683},{"id":"https://openalex.org/keywords/prompt-engineering","display_name":"prompt engineering","score":0.6859999895095825},{"id":"https://openalex.org/keywords/snyk","display_name":"Snyk","score":0.7440000176429749},{"id":"https://openalex.org/keywords/pyre","display_name":"pyrE","score":0.5540000200271606},{"id":"https://openalex.org/keywords/trivy","display_name":"Trivy","score":0.8180000185966492},{"id":"https://openalex.org/keywords/pylint","display_name":"Pylint","score":0.47600001096725464},{"id":"https://openalex.org/keywords/software-security","display_name":"software security","score":0.3199999928474426}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7950485348701477},{"id":"https://openalex.org/C22680326","wikidata":"https://www.wikidata.org/wiki/Q7444867","display_name":"Secure coding","level":5,"score":0.628119170665741},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.6001034379005432},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5213107466697693},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.507630467414856},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.5039343237876892},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.4596722722053528},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.4116244614124298},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.3742601275444031},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.24726110696792603},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.2336243987083435},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.0},{"id":"https://openalex.org/C29983905","wikidata":"https://www.wikidata.org/wiki/Q7445066","display_name":"Security service","level":3,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3655693.3655701","doi":"https://doi.org/10.1145/3655693.3655701","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3655693.3655701","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3655693.3655701","source":{"id":"https://openalex.org/S7407088847","display_name":"European Interdisciplinary Cybersecurity Conference (EICC)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"European Interdisciplinary Cybersecurity Conference","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3655693.3655701","doi":"https://doi.org/10.1145/3655693.3655701","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3655693.3655701","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3655693.3655701","source":{"id":"https://openalex.org/S7407088847","display_name":"European Interdisciplinary Cybersecurity Conference (EICC)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"European Interdisciplinary Cybersecurity Conference","raw_type":"proceedings-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4399331997.pdf","grobid_xml":"https://content.openalex.org/works/W4399331997.grobid-xml"},"referenced_works_count":10,"referenced_works":["https://openalex.org/W2793157084","https://openalex.org/W2990685757","https://openalex.org/W3033053557","https://openalex.org/W3086100325","https://openalex.org/W3091588759","https://openalex.org/W3177116043","https://openalex.org/W4285490477","https://openalex.org/W4378554228","https://openalex.org/W4384918448","https://openalex.org/W4386273017"],"related_works":["https://openalex.org/W4410537167","https://openalex.org/W7163756312","https://openalex.org/W4416429238","https://openalex.org/W4402444076","https://openalex.org/W4407390759","https://openalex.org/W4404569041","https://openalex.org/W7167261681","https://openalex.org/W4386081319","https://openalex.org/W4411523022","https://openalex.org/W4405561617"],"abstract_inverted_index":{"In":[0,87,181],"the":[1,31,73,129,139,152,161,172,178,186,208],"rapidly":[2],"changing":[3],"world":[4],"of":[5,35,75,84,124,154,169,203],"digital":[6,53],"technologies,":[7],"application":[8],"programming":[9],"interfaces":[10],"(APIs)":[11],"have":[12],"become":[13],"extremely":[14],"important":[15],"to":[16,21,120,134],"allow":[17,79],"different":[18],"software":[19,45],"applications":[20],"communicate":[22],"with":[23,56,109,165,210],"each":[24,57,107,136],"other.":[25,58],"This":[26,38],"communication":[27],"has":[28],"greatly":[29],"enhanced":[30],"capabilities":[32],"and":[33,82,100,175,222],"functionality":[34],"web":[36],"applications.":[37],"shift":[39],"towards":[40],"using":[41],"more":[42],"APIs":[43,71],"in":[44,51,128,151,189,239],"development":[46],"marks":[47],"a":[48,92,122,166,198,211],"major":[49],"change":[50],"how":[52],"services":[54],"connect":[55],"However,":[59],"this":[60,88],"progress":[61],"also":[62],"brings":[63],"certain":[64,240],"security":[65,85],"concerns.":[66],"The":[67],"increasing":[68],"reliance":[69],"on":[70,116],"underscores":[72],"importance":[74],"employing":[76],"tools":[77],"that":[78,94,232],"early":[80],"detection":[81,167,201,213],"remediation":[83],"vulnerabilities.":[86,205,228],"paper,":[89],"we":[90],"detail":[91],"study":[93],"engaged":[95],"10":[96,142],"static":[97,193,234],"code":[98,194,235],"analysers":[99,217,236],"four":[101],"popular":[102],"Large":[103],"Language":[104],"Models":[105],"(LLMs),":[106],"queried":[108],"two":[110],"unique":[111],"prompts.":[112,191],"Our":[113,146],"focus":[114],"was":[115],"assessing":[117],"their":[118,242],"ability":[119],"detect":[121,226],"compilation":[123],"40":[125],"API":[126,143,204],"vulnerabilities":[127],"source":[130],"code,":[131],"specifically":[132],"selected":[133],"represent":[135],"category":[137],"within":[138],"OWASP":[140],"Top":[141],"Security":[144],"Risks.":[145],"results":[147,196],"revealed":[148],"significant":[149],"variations":[150],"performance":[153],"these":[155],"tools.":[156],"ChatGPT":[157],"4":[158],"emerged":[159],"as":[160,219],"most":[162],"effective":[163],"LLM,":[164],"rate":[168,202],"62.5%":[170],"for":[171,177],"first":[173],"prompt":[174],"42.5%":[176],"second":[179],"prompt.":[180],"contrast,":[182],"LLaMA":[183],"2":[184],"showed":[185,197],"lowest":[187],"effectiveness":[188,243],"both":[190],"Meanwhile,":[192],"analyser":[195],"generally":[199],"low":[200],"Snyk":[206],"led":[207],"group":[209],"25%":[212],"rate,":[214],"while":[215,233],"several":[216],"such":[218],"pylint,":[220],"Pyre,":[221],"Trivy":[223],"did":[224],"not":[225],"any":[227],"These":[229],"findings":[230],"indicate":[231],"are":[237],"valuable":[238],"contexts,":[241],"remains":[244],"lower":[245],"than":[246],"LLMs":[247],"when":[248],"appropriately":[249],"prompted.":[250]},"counts_by_year":[{"year":2026,"cited_by_count":8},{"year":2025,"cited_by_count":9},{"year":2024,"cited_by_count":1}],"updated_date":"2026-11-14T11:04:58.165337","created_date":"2024-06-05T00:00:00"}