{"id":"https://openalex.org/W7118180304","doi":"https://doi.org/10.3390/app16010517","title":"CQLLM: A Framework for Generating CodeQL Security Vulnerability Detection Code Based on Large Language Model","display_name":"CQLLM: A Framework for Generating CodeQL Security Vulnerability Detection Code Based on Large Language Model","publication_year":2026,"publication_date":"2026-01-04","ids":{"openalex":"https://openalex.org/W7118180304","doi":"https://doi.org/10.3390/app16010517"},"language":"en","primary_location":{"id":"doi:10.3390/app16010517","doi":"https://doi.org/10.3390/app16010517","is_oa":true,"landing_page_url":"https://doi.org/10.3390/app16010517","pdf_url":"https://www.mdpi.com/2076-3417/16/1/517/pdf","source":{"id":"https://openalex.org/S4210205812","display_name":"Applied Sciences","issn_l":"2076-3417","issn":["2076-3417"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["anvur-class-a","anvur-scientific","cwts-core","doaj","norway-1","poland-100","russia-white-list-2","vabb-shw"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Applied Sciences","raw_type":"journal-article"},"volume":null,"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://www.mdpi.com/2076-3417/16/1/517/pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100350793","display_name":"Le Wang","orcid":"https://orcid.org/0000-0002-3610-9185","observed_orcids":["https://orcid.org/0000-0002-3610-9185"]},"institutions":[{"id":"https://openalex.org/I37987034","display_name":"Guangzhou University","ror":"https://ror.org/05ar8rn06","country_code":"CN","type":"education","lineage":["https://openalex.org/I37987034"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Le Wang","raw_affiliation_strings":["Cyberspace Institute of Advanced Technology , Guangzhou University , Guangzhou 510006 , China"],"raw_orcid":"https://orcid.org/0000-0002-3610-9185","affiliations":[{"raw_affiliation_string":"Cyberspace Institute of Advanced Technology , Guangzhou University , Guangzhou 510006 , China","institution_ids":["https://openalex.org/I37987034"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100766422","display_name":"Chan Chen","orcid":"https://orcid.org/0000-0001-5823-8247","observed_orcids":["https://orcid.org/0000-0001-5823-8247","https://orcid.org/0009-0006-2225-1785"]},"institutions":[{"id":"https://openalex.org/I37987034","display_name":"Guangzhou University","ror":"https://ror.org/05ar8rn06","country_code":"CN","type":"education","lineage":["https://openalex.org/I37987034"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Chan Chen","raw_affiliation_strings":["Cyberspace Institute of Advanced Technology , Guangzhou University , Guangzhou 510006 , China"],"raw_orcid":"https://orcid.org/0009-0006-2225-1785","affiliations":[{"raw_affiliation_string":"Cyberspace Institute of Advanced Technology , Guangzhou University , Guangzhou 510006 , China","institution_ids":["https://openalex.org/I37987034"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5121951312","display_name":"Junyi Zhu","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I3045169105","display_name":"Southern University of Science and Technology","ror":"https://ror.org/049tv2d57","country_code":"CN","type":"education","lineage":["https://openalex.org/I3045169105"]},{"id":"https://openalex.org/I4210136793","display_name":"Peng Cheng Laboratory","ror":"https://ror.org/03qdqbt06","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210136793"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Junyi Zhu","raw_affiliation_strings":["Department of New Networks , Peng Cheng Laboratory , Xili Street , Shenzhen 518000 , China","Southern University of Science and Technology , Shenzhen 518055 , China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of New Networks , Peng Cheng Laboratory , Xili Street , Shenzhen 518000 , China","institution_ids":["https://openalex.org/I4210136793"]},{"raw_affiliation_string":"Southern University of Science and Technology , Shenzhen 518055 , China","institution_ids":["https://openalex.org/I3045169105"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5097929460","display_name":"Rufeng Zhan","orcid":"https://orcid.org/0009-0009-0471-0791","observed_orcids":["https://orcid.org/0009-0009-0471-0791"]},"institutions":[{"id":"https://openalex.org/I37987034","display_name":"Guangzhou University","ror":"https://ror.org/05ar8rn06","country_code":"CN","type":"education","lineage":["https://openalex.org/I37987034"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Rufeng Zhan","raw_affiliation_strings":["Cyberspace Institute of Advanced Technology , Guangzhou University , Guangzhou 510006 , China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Cyberspace Institute of Advanced Technology , Guangzhou University , Guangzhou 510006 , China","institution_ids":["https://openalex.org/I37987034"]}]},{"author_position":"last","author":{"id":null,"display_name":"Weihong Han","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I3045169105","display_name":"Southern University of Science and Technology","ror":"https://ror.org/049tv2d57","country_code":"CN","type":"education","lineage":["https://openalex.org/I3045169105"]},{"id":"https://openalex.org/I4210136793","display_name":"Peng Cheng Laboratory","ror":"https://ror.org/03qdqbt06","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210136793"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"Weihong Han","raw_affiliation_strings":["Department of New Networks , Peng Cheng Laboratory , Xili Street , Shenzhen 518000 , China","Southern University of Science and Technology , Shenzhen 518055 , China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of New Networks , Peng Cheng Laboratory , Xili Street , Shenzhen 518000 , China","institution_ids":["https://openalex.org/I4210136793"]},{"raw_affiliation_string":"Southern University of Science and Technology , Shenzhen 518055 , China","institution_ids":["https://openalex.org/I3045169105"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I3045169105","https://openalex.org/I4210136793"],"apc_list":{"value":2400,"currency":"CHF","value_usd":2896},"apc_paid":{"value":2400,"currency":"CHF","value_usd":2896},"fwci":56.2373,"has_fulltext":true,"cited_by_count":6,"citation_normalized_percentile":{"value":0.99723757,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":98,"max":99},"biblio":{"volume":"16","issue":"1","first_page":"517","last_page":"517"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.8833000063896179,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.8833000063896179,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.06880000233650208,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.02329999953508377,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/codeql","display_name":"CodeQL","score":0.9890000224113464},{"id":"https://openalex.org/keywords/large-language-models","display_name":"large language models","score":0.7900000214576721},{"id":"https://openalex.org/keywords/vulnerability-detection","display_name":"vulnerability detection","score":0.7260000109672546},{"id":"https://openalex.org/keywords/retrieval-augmented-generation","display_name":"retrieval-augmented generation","score":0.902999997138977},{"id":"https://openalex.org/keywords/static-code-analysis","display_name":"static code analysis","score":0.8859999775886536},{"id":"https://openalex.org/keywords/shift-left-security","display_name":"shift-left security","score":0.9850000143051147}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8513000011444092},{"id":"https://openalex.org/C55439883","wikidata":"https://www.wikidata.org/wiki/Q360812","display_name":"Correctness","level":2,"score":0.6424000263214111},{"id":"https://openalex.org/C133162039","wikidata":"https://www.wikidata.org/wiki/Q1061077","display_name":"Code generation","level":3,"score":0.5410000085830688},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.492000013589859},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.46709999442100525},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.4627000093460083},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.44359999895095825},{"id":"https://openalex.org/C137287247","wikidata":"https://www.wikidata.org/wiki/Q1329550","display_name":"Static program analysis","level":4,"score":0.4433000087738037},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.43130001425743103},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.42080000042915344},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.4115000069141388},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.40689998865127563},{"id":"https://openalex.org/C77109596","wikidata":"https://www.wikidata.org/wiki/Q4781497","display_name":"Application security","level":5,"score":0.37599998712539673},{"id":"https://openalex.org/C19768560","wikidata":"https://www.wikidata.org/wiki/Q320727","display_name":"Dependency (UML)","level":2,"score":0.37229999899864197},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.36570000648498535},{"id":"https://openalex.org/C22680326","wikidata":"https://www.wikidata.org/wiki/Q7444867","display_name":"Secure coding","level":5,"score":0.35749998688697815},{"id":"https://openalex.org/C172776598","wikidata":"https://www.wikidata.org/wiki/Q7943570","display_name":"Vulnerability management","level":4,"score":0.3174999952316284},{"id":"https://openalex.org/C124304363","wikidata":"https://www.wikidata.org/wiki/Q673661","display_name":"Abstraction","level":2,"score":0.3093000054359436},{"id":"https://openalex.org/C150292731","wikidata":"https://www.wikidata.org/wiki/Q1342704","display_name":"Code review","level":5,"score":0.2847999930381775},{"id":"https://openalex.org/C529173508","wikidata":"https://www.wikidata.org/wiki/Q638608","display_name":"Software development","level":3,"score":0.27390000224113464},{"id":"https://openalex.org/C2779639559","wikidata":"https://www.wikidata.org/wiki/Q7661178","display_name":"Symbolic execution","level":3,"score":0.27149999141693115},{"id":"https://openalex.org/C76518257","wikidata":"https://www.wikidata.org/wiki/Q271680","display_name":"Software framework","level":5,"score":0.2621999979019165}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.3390/app16010517","doi":"https://doi.org/10.3390/app16010517","is_oa":true,"landing_page_url":"https://doi.org/10.3390/app16010517","pdf_url":"https://www.mdpi.com/2076-3417/16/1/517/pdf","source":{"id":"https://openalex.org/S4210205812","display_name":"Applied Sciences","issn_l":"2076-3417","issn":["2076-3417"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["anvur-class-a","anvur-scientific","cwts-core","doaj","norway-1","poland-100","russia-white-list-2","vabb-shw"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Applied Sciences","raw_type":"journal-article"},{"id":"doi:10.20944/preprints202510.1458.v1","doi":"https://doi.org/10.20944/preprints202510.1458.v1","is_oa":true,"landing_page_url":"https://doi.org/10.20944/preprints202510.1458.v1","pdf_url":"https://www.preprints.org/frontend/manuscript/001ae6e93ad724d4cd1f3912d5f2eb23/download_pub","source":{"id":"https://openalex.org/S6309402219","display_name":"Preprints.org","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"acceptedVersion","is_accepted":true,"is_published":false,"raw_source_name":null,"raw_type":"posted-content"},{"id":"pmh:oai:doaj.org/article:981ced10032844608ccca43949375073","doi":null,"is_oa":true,"landing_page_url":"https://doaj.org/article/981ced10032844608ccca43949375073","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Applied Sciences, Vol 16, Iss 1, p 517 (2026)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.3390/app16010517","doi":"https://doi.org/10.3390/app16010517","is_oa":true,"landing_page_url":"https://doi.org/10.3390/app16010517","pdf_url":"https://www.mdpi.com/2076-3417/16/1/517/pdf","source":{"id":"https://openalex.org/S4210205812","display_name":"Applied Sciences","issn_l":"2076-3417","issn":["2076-3417"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["anvur-class-a","anvur-scientific","cwts-core","doaj","norway-1","poland-100","russia-white-list-2","vabb-shw"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Applied Sciences","raw_type":"journal-article"},"sustainable_development_goals":[],"sustainable_development_goals_aurora":[],"study_designs":[],"awards":[{"id":"https://openalex.org/G106802601","display_name":null,"funder_award_id":"W2511073","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G353269639","display_name":null,"funder_award_id":"62572136","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G5585993018","display_name":null,"funder_award_id":"2023A1515011698","funder_id":"https://openalex.org/F4320337111","funder_display_name":"Basic and Applied Basic Research Foundation of Guangdong Province"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320337111","display_name":"Basic and Applied Basic Research Foundation of Guangdong Province","ror":null}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7118180304.pdf","grobid_xml":"https://content.openalex.org/works/W7118180304.grobid-xml"},"referenced_works_count":16,"referenced_works":["https://openalex.org/W1966831167","https://openalex.org/W1992114977","https://openalex.org/W2080696000","https://openalex.org/W2127637733","https://openalex.org/W2138369269","https://openalex.org/W2150874411","https://openalex.org/W2158297335","https://openalex.org/W3198685994","https://openalex.org/W4308643004","https://openalex.org/W4385562549","https://openalex.org/W4390188126","https://openalex.org/W4391032878","https://openalex.org/W4394864410","https://openalex.org/W4396571402","https://openalex.org/W4396823873","https://openalex.org/W4399597618"],"related_works":[],"abstract_inverted_index":{"With":[0],"the":[1,7,30,38,47,58,77,120,138,141,170,184,189,195,201,205,230,233,236,241,250,253,258,268,279,282],"increasing":[2],"complexity":[3,79],"of":[4,9,61,80,122,143,197,240,252,281,290],"software":[5,14,31],"systems,":[6],"number":[8],"security":[10,21,63,124],"vulnerabilities":[11,28],"contained":[12],"within":[13],"has":[15],"risen":[16],"accordingly.":[17],"The":[18],"existing":[19],"shift-left":[20,62],"concept":[22],"aims":[23],"to":[24,52,86,95,135,168,183,217,265],"detect":[25],"and":[26,93,140,157,176,193,204,220,238],"fix":[27],"during":[29],"development":[32],"cycle.":[33],"While":[34,65],"CodeQL":[35,123],"stands":[36],"as":[37,90],"premier":[39],"static":[40,150],"code":[41,75,81,127,146,151,177],"analysis":[42,152],"tool":[43],"currently":[44],"available":[45],"on":[46],"market,":[48],"its":[49,297],"high":[50],"barrier":[51],"entry":[53],"poses":[54],"challenges":[55],"for":[56,118,153,160,173],"meeting":[57],"implementation":[59],"requirements":[60],"initiatives.":[64],"large":[66,231,273],"language":[67],"model":[68,270],"(LLM)":[69],"offers":[70],"potential":[71],"assistance":[72],"in":[73,104,292,300],"QL":[74,145,222,255],"development,":[76],"inherent":[78],"generation":[82,121,164,191],"tasks":[83],"often":[84],"leads":[85],"persistent":[87],"issues":[88],"such":[89],"syntactic":[91],"inaccuracies":[92],"references":[94],"non-existent":[96],"modules,":[97],"which":[98],"consequently":[99],"constrains":[100],"their":[101],"practical":[102,298],"applicability":[103,299],"this":[105,111],"domain.":[106],"To":[107],"address":[108],"these":[109],"challenges,":[110],"paper":[112],"proposes":[113],"CQLLM,":[114],"a":[115,154,214,272,286],"novel":[116],"framework":[117,132,234],"automating":[119],"vulnerability":[125,161,293,302],"detection":[126,294],"by":[128,209,271],"leveraging":[129],"LLM.":[130],"This":[131],"is":[133,166],"designed":[134],"enhance":[136],"both":[137],"efficiency":[139],"accuracy":[142],"automated":[144],"generation,":[147],"thereby":[148,187],"advancing":[149],"more":[155],"efficient":[156],"intelligent":[158],"paradigm":[159],"detection.First,":[162],"retrieval-augmented":[163],"(RAG)":[165],"employed":[167],"search":[169],"vector":[171],"database":[172],"dependency":[174],"libraries":[175],"snippets":[178],"that":[179,246],"are":[180,211],"highly":[181],"similar":[182],"user\u2019s":[185],"input,":[186],"constraining":[188],"model\u2019s":[190],"process":[192],"preventing":[194],"import":[196],"invalid":[198],"modules.":[199],"Then,":[200],"user":[202],"input":[203],"knowledge":[206,227],"chunks":[207],"retrieved":[208],"RAG":[210],"fed":[212],"into":[213],"fine-tuned":[215],"LLM":[216],"perform":[218],"reasoning":[219],"generate":[221],"code.":[223],"By":[224],"integrating":[225],"external":[226],"bases":[228],"with":[229,257],"model,":[232],"enhances":[235,278],"correctness":[237],"completeness":[239],"generated":[242,254,283],"code.Experimental":[243],"results":[244],"show":[245],"CQLLM":[247,276],"significantly":[248],"improves":[249],"executability":[251],"code,":[256],"execution":[259],"success":[260],"rate":[261,289],"improving":[262],"from":[263],"0.31%":[264],"72.48%,":[266],"outperforming":[267],"original":[269],"margin.":[274],"Meanwhile,":[275],"also":[277],"effectiveness":[280],"results,":[284],"achieving":[285],"CWE":[287],"coverage":[288],"57.4%":[291],"tasks,":[295],"demonstrating":[296],"real-world":[301],"detection.":[303]},"counts_by_year":[{"year":2026,"cited_by_count":6}],"updated_date":"2026-10-09T09:14:12.587421","created_date":"2026-01-05T00:00:00"}