{"id":"https://openalex.org/W4414988681","doi":"https://doi.org/10.1109/tse.2025.3619281","title":"Towards Secure Code Generation With LLMs: A Study on Common Weakness Enumeration","display_name":"Towards Secure Code Generation With LLMs: A Study on Common Weakness Enumeration","publication_year":2025,"publication_date":"2025-10-09","ids":{"openalex":"https://openalex.org/W4414988681","doi":"https://doi.org/10.1109/tse.2025.3619281"},"language":"en","primary_location":{"id":"doi:10.1109/tse.2025.3619281","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tse.2025.3619281","pdf_url":null,"source":{"id":"https://openalex.org/S8351582","display_name":"IEEE Transactions on Software Engineering","issn_l":"0098-5589","issn":["0098-5589","1939-3520","2326-3881"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Software Engineering","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5112391220","display_name":"Jianguo Zhao","orcid":"https://orcid.org/0000-0002-4701-1570"},"institutions":[{"id":"https://openalex.org/I24185976","display_name":"Sichuan University","ror":"https://ror.org/011ashp19","country_code":"CN","type":"education","lineage":["https://openalex.org/I24185976"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jianguo Zhao","raw_affiliation_strings":["School of Cyber Science and Engineering, Sichuan University, Chengdu, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyber Science and Engineering, Sichuan University, Chengdu, China","institution_ids":["https://openalex.org/I24185976"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102959778","display_name":"Yuqiang Sun","orcid":"https://orcid.org/0000-0003-4340-3371"},"institutions":[{"id":"https://openalex.org/I172675005","display_name":"Nanyang Technological University","ror":"https://ror.org/02e7b5302","country_code":"SG","type":"education","lineage":["https://openalex.org/I172675005"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Yuqiang Sun","raw_affiliation_strings":["Nanyang Technological University, Singapore","Nanyang Technological University Singapore, Singapore"],"raw_orcid":"https://orcid.org/0000-0003-4340-3371","affiliations":[{"raw_affiliation_string":"Nanyang Technological University, Singapore","institution_ids":["https://openalex.org/I172675005"]},{"raw_affiliation_string":"Nanyang Technological University Singapore, Singapore","institution_ids":["https://openalex.org/I172675005"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Cheng Huang","orcid":"https://orcid.org/0000-0002-5871-946X"},"institutions":[{"id":"https://openalex.org/I24185976","display_name":"Sichuan University","ror":"https://ror.org/011ashp19","country_code":"CN","type":"education","lineage":["https://openalex.org/I24185976"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Cheng Huang","raw_affiliation_strings":["School of Cyber Science and Engineering, Sichuan University, Chengdu, China"],"raw_orcid":"https://orcid.org/0000-0002-5871-946X","affiliations":[{"raw_affiliation_string":"School of Cyber Science and Engineering, Sichuan University, Chengdu, China","institution_ids":["https://openalex.org/I24185976"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Chengwei Liu","orcid":"https://orcid.org/0000-0003-1175-2753"},"institutions":[{"id":"https://openalex.org/I172675005","display_name":"Nanyang Technological University","ror":"https://ror.org/02e7b5302","country_code":"SG","type":"education","lineage":["https://openalex.org/I172675005"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Chengwei Liu","raw_affiliation_strings":["Nanyang Technological University, Singapore","Nanyang Technological University Singapore, Singapore"],"raw_orcid":"https://orcid.org/0000-0003-1175-2753","affiliations":[{"raw_affiliation_string":"Nanyang Technological University, Singapore","institution_ids":["https://openalex.org/I172675005"]},{"raw_affiliation_string":"Nanyang Technological University Singapore, Singapore","institution_ids":["https://openalex.org/I172675005"]}]},{"author_position":"middle","author":{"id":null,"display_name":"YaoHui Guan","orcid":null},"institutions":[{"id":"https://openalex.org/I115212828","display_name":"Beijing Language and Culture University","ror":"https://ror.org/03te2zs36","country_code":"CN","type":"education","lineage":["https://openalex.org/I115212828"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"YaoHui Guan","raw_affiliation_strings":["Beijing Language and Culture University, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Beijing Language and Culture University, Beijing, China","institution_ids":["https://openalex.org/I115212828"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Yutong Zeng","orcid":null},"institutions":[{"id":"https://openalex.org/I24185976","display_name":"Sichuan University","ror":"https://ror.org/011ashp19","country_code":"CN","type":"education","lineage":["https://openalex.org/I24185976"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yutong Zeng","raw_affiliation_strings":["School of Cyber Science and Engineering, Sichuan University, Chengdu, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyber Science and Engineering, Sichuan University, Chengdu, China","institution_ids":["https://openalex.org/I24185976"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100355692","display_name":"Yang Liu","orcid":"https://orcid.org/0000-0001-7300-9215"},"institutions":[{"id":"https://openalex.org/I172675005","display_name":"Nanyang Technological University","ror":"https://ror.org/02e7b5302","country_code":"SG","type":"education","lineage":["https://openalex.org/I172675005"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Yang Liu","raw_affiliation_strings":["Nanyang Technological University, Singapore","Nanyang Technological University Singapore, Singapore"],"raw_orcid":"https://orcid.org/0000-0001-7300-9215","affiliations":[{"raw_affiliation_string":"Nanyang Technological University, Singapore","institution_ids":["https://openalex.org/I172675005"]},{"raw_affiliation_string":"Nanyang Technological University Singapore, Singapore","institution_ids":["https://openalex.org/I172675005"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":7.6891,"has_fulltext":false,"cited_by_count":4,"citation_normalized_percentile":{"value":0.97211516,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":91,"max":99},"biblio":{"volume":"51","issue":"12","first_page":"3507","last_page":"3523"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.942300021648407,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.942300021648407,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9218000173568726,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/code-generation","display_name":"Code generation","score":0.5871999859809875},{"id":"https://openalex.org/keywords/code-reuse","display_name":"Code reuse","score":0.4717000126838684},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.38089999556541443},{"id":"https://openalex.org/keywords/code-review","display_name":"Code review","score":0.3562999963760376},{"id":"https://openalex.org/keywords/static-program-analysis","display_name":"Static program analysis","score":0.3488999903202057},{"id":"https://openalex.org/keywords/natural-language-generation","display_name":"Natural language generation","score":0.33719998598098755},{"id":"https://openalex.org/keywords/kpi-driven-code-analysis","display_name":"KPI-driven code analysis","score":0.33660000562667847},{"id":"https://openalex.org/keywords/software-quality","display_name":"Software quality","score":0.33329999446868896},{"id":"https://openalex.org/keywords/redundant-code","display_name":"Redundant code","score":0.32420000433921814}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8489999771118164},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.6371999979019165},{"id":"https://openalex.org/C133162039","wikidata":"https://www.wikidata.org/wiki/Q1061077","display_name":"Code generation","level":3,"score":0.5871999859809875},{"id":"https://openalex.org/C2778583558","wikidata":"https://www.wikidata.org/wiki/Q771245","display_name":"Code reuse","level":3,"score":0.4717000126838684},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.43799999356269836},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.38089999556541443},{"id":"https://openalex.org/C150292731","wikidata":"https://www.wikidata.org/wiki/Q1342704","display_name":"Code review","level":5,"score":0.3562999963760376},{"id":"https://openalex.org/C137287247","wikidata":"https://www.wikidata.org/wiki/Q1329550","display_name":"Static program analysis","level":4,"score":0.3488999903202057},{"id":"https://openalex.org/C2776187449","wikidata":"https://www.wikidata.org/wiki/Q1513879","display_name":"Natural language generation","level":3,"score":0.33719998598098755},{"id":"https://openalex.org/C121957198","wikidata":"https://www.wikidata.org/wiki/Q14365593","display_name":"KPI-driven code analysis","level":5,"score":0.33660000562667847},{"id":"https://openalex.org/C117447612","wikidata":"https://www.wikidata.org/wiki/Q1412670","display_name":"Software quality","level":4,"score":0.33329999446868896},{"id":"https://openalex.org/C151578736","wikidata":"https://www.wikidata.org/wiki/Q1251793","display_name":"Redundant code","level":4,"score":0.32420000433921814},{"id":"https://openalex.org/C22680326","wikidata":"https://www.wikidata.org/wiki/Q7444867","display_name":"Secure coding","level":5,"score":0.3231000006198883},{"id":"https://openalex.org/C51929080","wikidata":"https://www.wikidata.org/wiki/Q2425187","display_name":"Codebase","level":3,"score":0.32170000672340393},{"id":"https://openalex.org/C152752567","wikidata":"https://www.wikidata.org/wiki/Q116877","display_name":"Code refactoring","level":3,"score":0.3172999918460846},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.313400000333786},{"id":"https://openalex.org/C92966194","wikidata":"https://www.wikidata.org/wiki/Q651794","display_name":"Compiled language","level":4,"score":0.31310001015663147},{"id":"https://openalex.org/C529173508","wikidata":"https://www.wikidata.org/wiki/Q638608","display_name":"Software development","level":3,"score":0.29989999532699585},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.29120001196861267},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.2827000021934509},{"id":"https://openalex.org/C50831359","wikidata":"https://www.wikidata.org/wiki/Q165436","display_name":"Assembly language","level":3,"score":0.2784999907016754},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.2685999870300293},{"id":"https://openalex.org/C128838566","wikidata":"https://www.wikidata.org/wiki/Q275603","display_name":"Logic programming","level":2,"score":0.2621000111103058},{"id":"https://openalex.org/C146222976","wikidata":"https://www.wikidata.org/wiki/Q1204997","display_name":"Business logic","level":2,"score":0.2587999999523163},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.25360000133514404}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/tse.2025.3619281","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tse.2025.3619281","pdf_url":null,"source":{"id":"https://openalex.org/S8351582","display_name":"IEEE Transactions on Software Engineering","issn_l":"0098-5589","issn":["0098-5589","1939-3520","2326-3881"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Software Engineering","raw_type":"journal-article"},{"id":"pmh:oai:dr.ntu.edu.sg:10356/218284","is_oa":false,"landing_page_url":"https://hdl.handle.net/10356/218284","pdf_url":null,"source":{"id":"https://openalex.org/S4306402609","display_name":"DR-NTU (Nanyang Technological University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I172675005","host_organization_name":"Nanyang Technological University","host_organization_lineage":["https://openalex.org/I172675005"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Journal Article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G5496080866","display_name":null,"funder_award_id":"62472296","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":26,"referenced_works":["https://openalex.org/W3091588759","https://openalex.org/W3198685994","https://openalex.org/W4252326246","https://openalex.org/W4285490477","https://openalex.org/W4308627320","https://openalex.org/W4308641648","https://openalex.org/W4308643319","https://openalex.org/W4367672983","https://openalex.org/W4382239980","https://openalex.org/W4384026520","https://openalex.org/W4384302744","https://openalex.org/W4384304916","https://openalex.org/W4386436496","https://openalex.org/W4388858772","https://openalex.org/W4389158474","https://openalex.org/W4389162178","https://openalex.org/W4391282616","https://openalex.org/W4393108609","https://openalex.org/W4393160302","https://openalex.org/W4394769342","https://openalex.org/W4395029328","https://openalex.org/W4396242417","https://openalex.org/W4403747722","https://openalex.org/W4414988681","https://openalex.org/W4415124086","https://openalex.org/W4416036206"],"related_works":[],"abstract_inverted_index":{"Automated":[0],"code":[1,30,39,109,135,144,158,178,218,239,249],"generation":[2,110,136,145,179],"has":[3,193],"revolutionized":[4],"software":[5,231],"development,":[6],"enabling":[7],"developers":[8],"to":[9,85,167,201,222,230,234],"accelerate":[10],"project":[11],"timelines":[12],"and":[13,96,186,197,205,219,247],"reduce":[14],"manual":[15],"coding":[16],"errors":[17],"significantly.":[18],"As":[19],"reliance":[20],"on":[21,123,189],"these":[22],"technologies":[23],"grows,":[24],"the":[25,76,91,105,108,113,124,134,156,173,176,212,216,235,248],"inherent":[26],"weaknesses":[27],"of":[28,48,80,90,107,131,175,227],"generated":[29,157],"become":[31],"increasingly":[32],"apparent.":[33],"Recent":[34],"studies":[35],"have":[36],"shown":[37],"that":[38,150,155],"produced":[40],"by":[41,243],"AI":[42],"is":[43,220],"not":[44,159,253],"inherently":[45],"safer":[46],"or":[47],"higher":[49],"quality":[50],"than":[51,225],"human-written":[52],"code,":[53,191],"often":[54],"replicating":[55],"existing":[56],"vulnerabilities.To":[57],"this":[58],"end,":[59],"we":[60],"propose":[61],"SECURECODER,":[62],"which":[63],"integrates":[64],"Retrieval-Augmented":[65],"Generation":[66],"(RAG)":[67],"with":[68,112],"Common":[69],"Weakness":[70],"Enumeration":[71],"(CWE).":[72],"SECURECODER":[73,127,192,208],"first":[74],"utilizes":[75],"advanced":[77],"reasoning":[78],"capabilities":[79],"large":[81],"language":[82,88],"models":[83],"(LLMs)":[84],"generate":[86],"natural":[87],"descriptions":[89,115],"code\u2019s":[92],"core":[93],"business":[94,250],"logic":[95,251],"functionality.":[97],"Then,":[98],"from":[99],"a":[100,117,129],"semantic":[101],"perspective,":[102],"it":[103],"matches":[104],"requirements":[106,163],"task":[111],"CWE":[114],"through":[116],"multi-label":[118],"classification":[119],"process.":[120,180],"Finally,":[121],"based":[122],"matched":[125],"CWE,":[126],"generates":[128],"list":[130],"security":[132,169,213],"guidelines":[133],"model":[137],"must":[138],"adhere":[139],"to.":[140],"Breaking":[141],"down":[142],"end-to-end":[143],"tasks":[146,149],"into":[147],"single-target":[148],"LLMs":[151,188],"excel":[152],"at":[153,244],"ensures":[154],"only":[160],"meets":[161],"functional":[162],"but":[164],"also":[165],"adheres":[166],"best":[168],"practices,":[170],"thereby":[171],"enhancing":[172],"interpretability":[174],"automated":[177],"After":[181],"evaluating":[182],"2":[183],"programming":[184,203],"languages":[185,204],"7":[187],"Coploit-generated":[190],"great":[194],"generalization":[195],"capability":[196],"could":[198,209],"be":[199],"applied":[200],"more":[202,224],"vulnerability":[206],"types.":[207],"significantly":[210],"decrease":[211],"weakness":[214],"in":[215],"AI-generated":[217],"able":[221],"mitigate":[223],"65%":[226],"vulnerabilities":[228,240],"exposed":[229],"developers.":[232],"Compared":[233],"baseline":[236],"open-source":[237],"LLMs,":[238],"were":[241],"reduced":[242],"least":[245],"14%":[246],"was":[252],"affected.":[254]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":1}],"updated_date":"2026-07-29T09:40:50.615796","created_date":"2025-10-10T00:00:00"}