{"id":"https://openalex.org/W7160950173","doi":"https://doi.org/10.1145/3770922","title":"Large Language Models in Software Security Analysis","display_name":"Large Language Models in Software Security Analysis","publication_year":2026,"publication_date":"2026-05-12","ids":{"openalex":"https://openalex.org/W7160950173","doi":"https://doi.org/10.1145/3770922"},"language":"en","primary_location":{"id":"doi:10.1145/3770922","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3770922","pdf_url":null,"source":{"id":"https://openalex.org/S103482838","display_name":"Communications of the ACM","issn_l":"0001-0782","issn":["0001-0782","1557-7317"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Communications of the ACM","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1145/3770922","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5134660758","display_name":"Dylan Wolff","orcid":null},"institutions":[{"id":"https://openalex.org/I165932596","display_name":"National University of Singapore","ror":"https://ror.org/01tgyzw49","country_code":"SG","type":"education","lineage":["https://openalex.org/I165932596"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Dylan Wolff","raw_affiliation_strings":["National University of Singapore, School of Computing, Singapore, Singapore, Singapore"],"raw_orcid":"https://orcid.org/0000-0002-6958-7159","affiliations":[{"raw_affiliation_string":"National University of Singapore, School of Computing, Singapore, Singapore, Singapore","institution_ids":["https://openalex.org/I165932596"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5060375528","display_name":"\u041c\u0430\u0440\u0442\u0438\u043d \u041c\u0438\u0440\u0447\u0435\u0432","orcid":"https://orcid.org/0000-0001-9145-964X"},"institutions":[{"id":"https://openalex.org/I165932596","display_name":"National University of Singapore","ror":"https://ror.org/01tgyzw49","country_code":"SG","type":"education","lineage":["https://openalex.org/I165932596"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Martin Mirchev","raw_affiliation_strings":["National University of Singapore, School of Computing, Singapore, Singapore, Singapore"],"raw_orcid":"https://orcid.org/0000-0001-9145-964X","affiliations":[{"raw_affiliation_string":"National University of Singapore, School of Computing, Singapore, Singapore, Singapore","institution_ids":["https://openalex.org/I165932596"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5060115298","display_name":"Abhik Roychoudhury","orcid":"https://orcid.org/0000-0002-7127-1137"},"institutions":[{"id":"https://openalex.org/I165932596","display_name":"National University of Singapore","ror":"https://ror.org/01tgyzw49","country_code":"SG","type":"education","lineage":["https://openalex.org/I165932596"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Abhik Roychoudhury","raw_affiliation_strings":["National University of Singapore, School of Computing, Singapore, Singapore, Singapore"],"raw_orcid":"https://orcid.org/0000-0002-7127-1137","affiliations":[{"raw_affiliation_string":"National University of Singapore, School of Computing, Singapore, Singapore, Singapore","institution_ids":["https://openalex.org/I165932596"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I165932596"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.62318601,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"69","issue":"6","first_page":"60","last_page":"67"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.35760000348091125,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.35760000348091125,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.09769999980926514,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.08950000256299973,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/software-security-assurance","display_name":"Software security assurance","score":0.7063000202178955},{"id":"https://openalex.org/keywords/leverage","display_name":"Leverage (statistics)","score":0.5113999843597412},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.4742000102996826},{"id":"https://openalex.org/keywords/transformative-learning","display_name":"Transformative learning","score":0.4392000138759613},{"id":"https://openalex.org/keywords/safeguarding","display_name":"Safeguarding","score":0.4156000018119812},{"id":"https://openalex.org/keywords/modeling-language","display_name":"Modeling language","score":0.3959999978542328},{"id":"https://openalex.org/keywords/software-development","display_name":"Software development","score":0.38929998874664307},{"id":"https://openalex.org/keywords/software-quality","display_name":"Software quality","score":0.3215999901294708},{"id":"https://openalex.org/keywords/threat-model","display_name":"Threat model","score":0.3165999948978424}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7534000277519226},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.7063000202178955},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.5130000114440918},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5120000243186951},{"id":"https://openalex.org/C153083717","wikidata":"https://www.wikidata.org/wiki/Q6535263","display_name":"Leverage (statistics)","level":2,"score":0.5113999843597412},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.4742000102996826},{"id":"https://openalex.org/C70587473","wikidata":"https://www.wikidata.org/wiki/Q7834111","display_name":"Transformative learning","level":2,"score":0.4392000138759613},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.43140000104904175},{"id":"https://openalex.org/C2776743756","wikidata":"https://www.wikidata.org/wiki/Q5097921","display_name":"Safeguarding","level":2,"score":0.4156000018119812},{"id":"https://openalex.org/C179603123","wikidata":"https://www.wikidata.org/wiki/Q1941921","display_name":"Modeling language","level":3,"score":0.3959999978542328},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.3937999904155731},{"id":"https://openalex.org/C529173508","wikidata":"https://www.wikidata.org/wiki/Q638608","display_name":"Software development","level":3,"score":0.38929998874664307},{"id":"https://openalex.org/C117447612","wikidata":"https://www.wikidata.org/wiki/Q1412670","display_name":"Software quality","level":4,"score":0.3215999901294708},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.3165999948978424},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.31049999594688416},{"id":"https://openalex.org/C131275738","wikidata":"https://www.wikidata.org/wiki/Q7445023","display_name":"Security bug","level":5,"score":0.30559998750686646},{"id":"https://openalex.org/C149091818","wikidata":"https://www.wikidata.org/wiki/Q2429814","display_name":"Software system","level":3,"score":0.2890999913215637},{"id":"https://openalex.org/C43214815","wikidata":"https://www.wikidata.org/wiki/Q7310987","display_name":"Reliability (semiconductor)","level":3,"score":0.2883000075817108},{"id":"https://openalex.org/C137287247","wikidata":"https://www.wikidata.org/wiki/Q1329550","display_name":"Static program analysis","level":4,"score":0.2799000144004822},{"id":"https://openalex.org/C74579156","wikidata":"https://www.wikidata.org/wiki/Q7554342","display_name":"Software peer review","level":5,"score":0.2687000036239624},{"id":"https://openalex.org/C114869243","wikidata":"https://www.wikidata.org/wiki/Q133735","display_name":"Security through obscurity","level":5,"score":0.2648000121116638},{"id":"https://openalex.org/C121822524","wikidata":"https://www.wikidata.org/wiki/Q5157582","display_name":"Computer security model","level":2,"score":0.26269999146461487},{"id":"https://openalex.org/C22680326","wikidata":"https://www.wikidata.org/wiki/Q7444867","display_name":"Secure coding","level":5,"score":0.26260000467300415},{"id":"https://openalex.org/C66429209","wikidata":"https://www.wikidata.org/wiki/Q7248499","display_name":"Programming complexity","level":5,"score":0.25839999318122864},{"id":"https://openalex.org/C77109596","wikidata":"https://www.wikidata.org/wiki/Q4781497","display_name":"Application security","level":5,"score":0.2574999928474426},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.25450000166893005},{"id":"https://openalex.org/C186846655","wikidata":"https://www.wikidata.org/wiki/Q3398377","display_name":"Software construction","level":4,"score":0.25440001487731934},{"id":"https://openalex.org/C195518309","wikidata":"https://www.wikidata.org/wiki/Q13424265","display_name":"Security testing","level":5,"score":0.25209999084472656}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3770922","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3770922","pdf_url":null,"source":{"id":"https://openalex.org/S103482838","display_name":"Communications of the ACM","issn_l":"0001-0782","issn":["0001-0782","1557-7317"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Communications of the ACM","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1145/3770922","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3770922","pdf_url":null,"source":{"id":"https://openalex.org/S103482838","display_name":"Communications of the ACM","issn_l":"0001-0782","issn":["0001-0782","1557-7317"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Communications of the ACM","raw_type":"journal-article"},"sustainable_development_goals":[{"score":0.6522781848907471,"display_name":"Industry, innovation and infrastructure","id":"https://metadata.un.org/sdg/9"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":18,"referenced_works":["https://openalex.org/W2002934700","https://openalex.org/W2170224888","https://openalex.org/W2343875716","https://openalex.org/W2511368574","https://openalex.org/W2777430404","https://openalex.org/W2899781671","https://openalex.org/W2979357014","https://openalex.org/W2998011150","https://openalex.org/W4244452926","https://openalex.org/W4308632293","https://openalex.org/W4384304865","https://openalex.org/W4384345745","https://openalex.org/W4391724785","https://openalex.org/W4396242417","https://openalex.org/W4400582623","https://openalex.org/W4402442868","https://openalex.org/W4402457546","https://openalex.org/W4411552133"],"related_works":[],"abstract_inverted_index":{"Cybersecurity":[0],"plays":[1],"a":[2,48,79,85,114,156],"pivotal":[3],"role":[4,174],"in":[5,74,97,108,154,179],"safeguarding":[6],"the":[7,31,82,134,149,172,181],"integrity":[8],"and":[9,17,28,33,94,152,177],"reliability":[10],"of":[11,35,84,136,175,183],"critical":[12],"systems\u2014spanning":[13],"healthcare,":[14],"commerce,":[15],"transportation,":[16],"power":[18],"infrastructure.":[19,38],"Yet":[20],"software":[21,37,98,184],"security":[22],"teams":[23],"are":[24],"often":[25],"critically":[26],"underfunded":[27],"understaffed,":[29],"given":[30],"breadth":[32],"complexity":[34],"our":[36],"Recently,":[39],"large":[40],"language":[41],"models":[42],"(LLMs)":[43],"have":[44],"proven":[45],"to":[46,69],"be":[47,67],"transformative":[49],"technology":[50],"that":[51,90,117,159],"is":[52],"reshaping":[53],"how":[54,64],"we":[55,62,147],"interact":[56],"with":[57,78],"software.":[58],"In":[59],"this":[60,166],"article,":[61],"explore":[63],"LLMs":[65,176],"can":[66,91,120,160,168],"leveraged":[68],"holistically":[70],"address":[71],"longstanding":[72],"challenges":[73,151],"cybersecurity.":[75],"We":[76,101,164],"start":[77],"discussion":[80],"on":[81],"structure":[83],"cyber":[86],"reasoning":[87],"system":[88,158],"(CRS)":[89],"both":[92],"detect":[93],"repair":[95],"vulnerabilities":[96],"autonomously":[99],".":[100],"follow":[102],"up":[103],"by":[104],"examining":[105],"LLMs\u2019":[106],"strengths":[107],"aiding":[109],"program":[110],"analysis":[111,124,138],"within":[112],"such":[113,126],"system,":[115],"finding":[116],"LLM-assisted":[118],"analyses":[119],"accomplish":[121],"several":[122],"difficult":[123],"tasks,":[125],"as":[127],"extrapolating":[128],"developer":[129],"intent,":[130],"filtering":[131],"or":[132,140],"augmenting":[133],"output":[135],"traditional":[137],"tools,":[139],"even":[141],"solving":[142],"complex":[143],"multilingual":[144],"constraints.":[145],"Lastly,":[146],"discuss":[148],"current":[150],"limitations":[153],"constructing":[155],"composite":[157],"leverage":[161],"these":[162],"components.":[163],"hope":[165],"article":[167],"provide":[169],"insights":[170],"into":[171],"evolving":[173],"inspiration":[178],"shaping":[180],"future":[182],"security.":[185]},"counts_by_year":[],"updated_date":"2026-05-29T06:17:43.578629","created_date":"2026-05-13T00:00:00"}