{"id":"https://openalex.org/W7224510462","doi":"https://doi.org/10.36602/sjfe.2026.v14.i01.06","title":"An AHP Framework for Evaluating Large Language Models in Software Vulnerability Assessment","display_name":"An AHP Framework for Evaluating Large Language Models in Software Vulnerability Assessment","publication_year":2026,"publication_date":"2026-10-29","ids":{"openalex":"https://openalex.org/W7224510462","doi":"https://doi.org/10.36602/sjfe.2026.v14.i01.06"},"language":"en","primary_location":{"id":"doi:10.36602/sjfe.2026.v14.i01.06","doi":"https://doi.org/10.36602/sjfe.2026.v14.i01.06","is_oa":true,"landing_page_url":"https://doi.org/10.36602/sjfe.2026.v14.i01.06","pdf_url":"https://journals.misuratau.edu.ly/edu/ojs/index.php/eduction/article/download/880/590","source":{"id":"https://openalex.org/S7407057423","display_name":"Scientific Journal of Faculty of Education Misurata University","issn_l":"2710-4141","issn":["2710-4141"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I152195623","host_organization_name":"Misurata University","host_organization_lineage":["https://openalex.org/I152195623"],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Scientific Journal of Faculty of Education, Misurata University","raw_type":"journal-article"},"volume":null,"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://journals.misuratau.edu.ly/edu/ojs/index.php/eduction/article/download/880/590","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5156025005","display_name":"Mohamed Abugharsa","orcid":"https://orcid.org/0000-0001-5284-828X","observed_orcids":["https://orcid.org/0000-0001-5284-828X"]},"institutions":[{"id":"https://openalex.org/I152195623","display_name":"Misurata University","ror":"https://ror.org/014fcf271","country_code":"LY","type":"education","lineage":["https://openalex.org/I152195623"]}],"countries":["LY"],"is_corresponding":false,"raw_author_name":"Mohamed Abugharsa","raw_affiliation_strings":["Department of Information Systems, Faculty of Information Technology, Misurata University, Libya"],"raw_orcid":"https://orcid.org/0000-0001-5284-828X","affiliations":[{"raw_affiliation_string":"Department of Information Systems, Faculty of Information Technology, Misurata University, Libya","institution_ids":["https://openalex.org/I152195623"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5071415486","display_name":"Ali M Abdulshahed","orcid":"https://orcid.org/0000-0001-7630-0606","observed_orcids":["https://orcid.org/0000-0001-7630-0606"]},"institutions":[{"id":"https://openalex.org/I152195623","display_name":"Misurata University","ror":"https://ror.org/014fcf271","country_code":"LY","type":"education","lineage":["https://openalex.org/I152195623"]}],"countries":["LY"],"is_corresponding":false,"raw_author_name":"Ali M. Abdulshahed","raw_affiliation_strings":["Department of Electrical and Electronic Engineering, Faculty of Engineering, Misurata University, Libya"],"raw_orcid":"https://orcid.org/0000-0001-7630-0606","affiliations":[{"raw_affiliation_string":"Department of Electrical and Electronic Engineering, Faculty of Engineering, Misurata University, Libya","institution_ids":["https://openalex.org/I152195623"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I152195623"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.88516697,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"14","issue":"01","first_page":"91","last_page":"110"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9351000189781189,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9351000189781189,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.020400000736117363,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10050","display_name":"Multi-Criteria Decision Making","score":0.0071000000461936,"subfield":{"id":"https://openalex.org/subfields/1803","display_name":"Management Science and Operations Research"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/large-language-models","display_name":"large language models","score":0.996999979019165},{"id":"https://openalex.org/keywords/software-vulnerability-assessment","display_name":"software vulnerability assessment","score":0.9449999928474426},{"id":"https://openalex.org/keywords/analytic-hierarchy-process","display_name":"analytic hierarchy process","score":0.8560000061988831},{"id":"https://openalex.org/keywords/llm-evaluation-framework","display_name":"LLM evaluation framework","score":0.8059999942779541},{"id":"https://openalex.org/keywords/false-positive-results","display_name":"false positives","score":0.414000004529953},{"id":"https://openalex.org/keywords/benchmarking","display_name":"benchmarking","score":0.4880000054836273},{"id":"https://openalex.org/keywords/stakeholder-priorities","display_name":"stakeholder priorities","score":0.6539999842643738}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.707099974155426},{"id":"https://openalex.org/C87345402","wikidata":"https://www.wikidata.org/wiki/Q485202","display_name":"Analytic hierarchy process","level":2,"score":0.6186000108718872},{"id":"https://openalex.org/C189430467","wikidata":"https://www.wikidata.org/wiki/Q7293293","display_name":"Ranking (information retrieval)","level":2,"score":0.5475000143051147},{"id":"https://openalex.org/C86251818","wikidata":"https://www.wikidata.org/wiki/Q816754","display_name":"Benchmarking","level":2,"score":0.5304999947547913},{"id":"https://openalex.org/C201305675","wikidata":"https://www.wikidata.org/wiki/Q852998","display_name":"Stakeholder","level":2,"score":0.4909999966621399},{"id":"https://openalex.org/C2776436953","wikidata":"https://www.wikidata.org/wiki/Q5163215","display_name":"Consistency (knowledge bases)","level":2,"score":0.4595000147819519},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.44200000166893005},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.42590001225471497},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.4223000109195709},{"id":"https://openalex.org/C43214815","wikidata":"https://www.wikidata.org/wiki/Q7310987","display_name":"Reliability (semiconductor)","level":3,"score":0.41659998893737793},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.41440001130104065},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.37940001487731934},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.36239999532699585},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.35670000314712524},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.3450999855995178},{"id":"https://openalex.org/C206345919","wikidata":"https://www.wikidata.org/wiki/Q20380951","display_name":"Resource (disambiguation)","level":2,"score":0.34209999442100525},{"id":"https://openalex.org/C2778348673","wikidata":"https://www.wikidata.org/wiki/Q739302","display_name":"Production (economics)","level":2,"score":0.296099990606308},{"id":"https://openalex.org/C206588197","wikidata":"https://www.wikidata.org/wiki/Q846574","display_name":"Reuse","level":2,"score":0.2946000099182129},{"id":"https://openalex.org/C200601418","wikidata":"https://www.wikidata.org/wiki/Q2193887","display_name":"Reliability engineering","level":1,"score":0.2833000123500824},{"id":"https://openalex.org/C31170391","wikidata":"https://www.wikidata.org/wiki/Q188619","display_name":"Hierarchy","level":2,"score":0.2777999937534332},{"id":"https://openalex.org/C29202148","wikidata":"https://www.wikidata.org/wiki/Q287260","display_name":"Resource allocation","level":2,"score":0.27709999680519104},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.27639999985694885},{"id":"https://openalex.org/C42475967","wikidata":"https://www.wikidata.org/wiki/Q194292","display_name":"Operations research","level":1,"score":0.2655999958515167},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.25699999928474426}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.36602/sjfe.2026.v14.i01.06","doi":"https://doi.org/10.36602/sjfe.2026.v14.i01.06","is_oa":true,"landing_page_url":"https://doi.org/10.36602/sjfe.2026.v14.i01.06","pdf_url":"https://journals.misuratau.edu.ly/edu/ojs/index.php/eduction/article/download/880/590","source":{"id":"https://openalex.org/S7407057423","display_name":"Scientific Journal of Faculty of Education Misurata University","issn_l":"2710-4141","issn":["2710-4141"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I152195623","host_organization_name":"Misurata University","host_organization_lineage":["https://openalex.org/I152195623"],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Scientific Journal of Faculty of Education, Misurata University","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.36602/sjfe.2026.v14.i01.06","doi":"https://doi.org/10.36602/sjfe.2026.v14.i01.06","is_oa":true,"landing_page_url":"https://doi.org/10.36602/sjfe.2026.v14.i01.06","pdf_url":"https://journals.misuratau.edu.ly/edu/ojs/index.php/eduction/article/download/880/590","source":{"id":"https://openalex.org/S7407057423","display_name":"Scientific Journal of Faculty of Education Misurata University","issn_l":"2710-4141","issn":["2710-4141"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I152195623","host_organization_name":"Misurata University","host_organization_lineage":["https://openalex.org/I152195623"],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Scientific Journal of Faculty of Education, Misurata University","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7224510462.pdf","grobid_xml":"https://content.openalex.org/works/W7224510462.grobid-xml"},"referenced_works_count":6,"referenced_works":["https://openalex.org/W1995945562","https://openalex.org/W2034960640","https://openalex.org/W4210690107","https://openalex.org/W4308627645","https://openalex.org/W4395064704","https://openalex.org/W4415328595"],"related_works":["https://openalex.org/W4402264467","https://openalex.org/W4417413585","https://openalex.org/W4417004080","https://openalex.org/W7148999199","https://openalex.org/W4412346700","https://openalex.org/W7116311477","https://openalex.org/W7196944786","https://openalex.org/W4416056388","https://openalex.org/W4414586169","https://openalex.org/W7129766304"],"abstract_inverted_index":{"Large":[0],"language":[1],"models":[2],"(LLMs)":[3],"can":[4],"assist":[5],"software":[6],"security":[7,59],"review,":[8],"but":[9],"detecting":[10],"more":[11],"weaknesses":[12],"may":[13],"increase":[14],"false":[15],"alarms,":[16],"unreliable":[17],"patches,":[18],"or":[19],"higher":[20],"costs.":[21],"This":[22],"methodological":[23],"paper":[24],"specifies":[25,95],"a":[26,39,47,168],"reproducible":[27],"Analytic":[28],"Hierarchy":[29],"Process":[30],"(AHP)":[31],"framework":[32,45],"for":[33],"evaluating":[34],"LLM-assisted":[35],"vulnerability":[36],"assessment":[37],"in":[38],"synthetic":[40],"banking-information":[41],"application.":[42],"Applying":[43],"the":[44,57,126],"to":[46,73,133],"local":[48],"operational":[49],"banking":[50,65],"system":[51],"was":[52,61,67,184],"not":[53,177],"feasible":[54],"because":[55],"obtaining":[56],"required":[58],"approvals":[60],"difficult;":[62],"no":[63,187],"production":[64,204],"infrastructure":[66],"tested.":[68],"Six":[69],"objectives":[70],"are":[71,174],"linked":[72],"measurable":[74],"indicators":[75],"covering":[76],"ground-truth":[77],"completeness,":[78],"detection,":[79],"classification":[80],"and":[81,87,90,98,113,123,153,165,186,200,210],"severity":[82],"assessment,":[83,110],"secure":[84],"remediation,":[85],"reliability":[86],"resource":[88],"use,":[89],"decision":[91],"sensitivity.":[92],"The":[93],"protocol":[94],"12":[96,99],"vulnerable":[97],"corrected":[100],"variants,":[101],"four":[102],"scenarios,":[103],"repeated":[104],"runs,":[105,196],"blinded":[106],"adjudication,":[107],"CVSS":[108],"v4.0":[109],"regression":[111],"tests,":[112],"paired":[114],"analysis.":[115],"A":[116,155],"comparison":[117],"with":[118,167],"SecurityEval,":[119],"CyberSecEval,":[120],"CyberSecEval":[121],"2,":[122],"BountyBench":[124],"positions":[125],"proposed":[127],"contribution":[128],"as":[129],"linking":[130],"verified":[131],"outcomes":[132],"stakeholder":[134,202],"priorities":[135],"rather":[136],"than":[137],"demonstrating":[138],"superior":[139],"benchmark":[140],"performance.":[141],"An":[142],"exact":[143],"reciprocal":[144],"AHP":[145],"example":[146],"uses":[147],"weights":[148,160],"of":[149,161,171],"0.40,":[150],"0.30,":[151],"0.20,":[152],"0.10.":[154],"separate":[156],"simulation":[157],"yields":[158],"group":[159],"0.3565,":[162],"0.2920,":[163],"0.2187,":[164],"0.1328,":[166],"consistency":[169],"ratio":[170],"0.0008.":[172],"These":[173],"constructed":[175],"examples,":[176],"elicited":[178],"expert":[179],"judgments.":[180],"No":[181],"LLM":[182],"benchmarking":[183],"performed,":[185],"model":[188],"ranking":[189],"is":[190],"claimed.":[191],"Empirical":[192],"validation":[193],"requires":[194,207],"archived":[195],"independently":[197],"assessed":[198],"outcomes,":[199],"human":[201],"judgments;":[203],"transfer":[205],"additionally":[206],"institutional":[208],"authorization":[209],"service-specific":[211],"validation.":[212]},"counts_by_year":[],"updated_date":"2026-11-04T10:54:05.112534","created_date":"2026-10-30T00:00:00"}