{"id":"https://openalex.org/W7161017374","doi":"https://doi.org/10.1145/3786165.3788439","title":"LLMs in Code Vulnerability Analysis: A Proof of Concept","display_name":"LLMs in Code Vulnerability Analysis: A Proof of Concept","publication_year":2026,"publication_date":"2026-04-12","ids":{"openalex":"https://openalex.org/W7161017374","doi":"https://doi.org/10.1145/3786165.3788439"},"language":null,"primary_location":{"id":"doi:10.1145/3786165.3788439","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3786165.3788439","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2026 IEEE/ACM 4th International Workshop on Software Vulnerability Management","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1145/3786165.3788439","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5123023883","display_name":"Shaznin Sultana","orcid":null},"institutions":[{"id":"https://openalex.org/I4210106879","display_name":"Ohio University","ror":"https://ror.org/01jr3y717","country_code":"US","type":"education","lineage":["https://openalex.org/I4210106879"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Shaznin Sultana","raw_affiliation_strings":["Ohio University, Athens, Ohio, USA"],"raw_orcid":"https://orcid.org/0009-0003-4955-4389","affiliations":[{"raw_affiliation_string":"Ohio University, Athens, Ohio, USA","institution_ids":["https://openalex.org/I4210106879"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5114386476","display_name":"Sadia Afreen","orcid":null},"institutions":[{"id":"https://openalex.org/I63135867","display_name":"University of Cincinnati","ror":"https://ror.org/01e3m7079","country_code":"US","type":"education","lineage":["https://openalex.org/I63135867"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Sadia Afreen","raw_affiliation_strings":["University of Cincinnati, Cincinnati, Ohio, USA"],"raw_orcid":"https://orcid.org/0000-0002-2188-8454","affiliations":[{"raw_affiliation_string":"University of Cincinnati, Cincinnati, Ohio, USA","institution_ids":["https://openalex.org/I63135867"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5136024189","display_name":"Nasir U. Eisty","orcid":"https://orcid.org/0000-0001-5228-4664"},"institutions":[{"id":"https://openalex.org/I75027704","display_name":"University of Tennessee at Knoxville","ror":"https://ror.org/020f3ap87","country_code":"US","type":"education","lineage":["https://openalex.org/I75027704"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Nasir U. Eisty","raw_affiliation_strings":["University of Tennessee, Knoxville, Tennessee, USA"],"raw_orcid":"https://orcid.org/0000-0001-5228-4664","affiliations":[{"raw_affiliation_string":"University of Tennessee, Knoxville, Tennessee, USA","institution_ids":["https://openalex.org/I75027704"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":2,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"17","last_page":"24"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.38670000433921814,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.38670000433921814,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.28380000591278076,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12423","display_name":"Software Reliability and Analysis Research","score":0.06400000303983688,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.6820999979972839},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.5806999802589417},{"id":"https://openalex.org/keywords/pace","display_name":"Pace","score":0.5220000147819519},{"id":"https://openalex.org/keywords/resilience","display_name":"Resilience (materials science)","score":0.5058000087738037},{"id":"https://openalex.org/keywords/vulnerability-assessment","display_name":"Vulnerability assessment","score":0.46540001034736633},{"id":"https://openalex.org/keywords/software-security-assurance","display_name":"Software security assurance","score":0.45500001311302185},{"id":"https://openalex.org/keywords/automation","display_name":"Automation","score":0.43459999561309814},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.4196999967098236},{"id":"https://openalex.org/keywords/vulnerability-management","display_name":"Vulnerability management","score":0.3521000146865845}],"concepts":[{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.6820999979972839},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6721000075340271},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5907999873161316},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.5806999802589417},{"id":"https://openalex.org/C2777526511","wikidata":"https://www.wikidata.org/wiki/Q691543","display_name":"Pace","level":2,"score":0.5220000147819519},{"id":"https://openalex.org/C2779585090","wikidata":"https://www.wikidata.org/wiki/Q3457762","display_name":"Resilience (materials science)","level":2,"score":0.5058000087738037},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.46540001034736633},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.45500001311302185},{"id":"https://openalex.org/C115901376","wikidata":"https://www.wikidata.org/wiki/Q184199","display_name":"Automation","level":2,"score":0.43459999561309814},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.4307999908924103},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.4196999967098236},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.3977000117301941},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.3682999908924103},{"id":"https://openalex.org/C172776598","wikidata":"https://www.wikidata.org/wiki/Q7943570","display_name":"Vulnerability management","level":4,"score":0.3521000146865845},{"id":"https://openalex.org/C2778062554","wikidata":"https://www.wikidata.org/wiki/Q3404031","display_name":"Security community","level":2,"score":0.34060001373291016},{"id":"https://openalex.org/C2778755073","wikidata":"https://www.wikidata.org/wiki/Q10858537","display_name":"Scale (ratio)","level":2,"score":0.33180001378059387},{"id":"https://openalex.org/C121822524","wikidata":"https://www.wikidata.org/wiki/Q5157582","display_name":"Computer security model","level":2,"score":0.3181000053882599},{"id":"https://openalex.org/C124978682","wikidata":"https://www.wikidata.org/wiki/Q1201019","display_name":"Proof of concept","level":2,"score":0.3028999865055084},{"id":"https://openalex.org/C149091818","wikidata":"https://www.wikidata.org/wiki/Q2429814","display_name":"Software system","level":3,"score":0.2980000078678131},{"id":"https://openalex.org/C529173508","wikidata":"https://www.wikidata.org/wiki/Q638608","display_name":"Software development","level":3,"score":0.2754000127315521},{"id":"https://openalex.org/C82214349","wikidata":"https://www.wikidata.org/wiki/Q657339","display_name":"Software metric","level":5,"score":0.2741999924182892},{"id":"https://openalex.org/C31170391","wikidata":"https://www.wikidata.org/wiki/Q188619","display_name":"Hierarchy","level":2,"score":0.2736999988555908},{"id":"https://openalex.org/C101317890","wikidata":"https://www.wikidata.org/wiki/Q940053","display_name":"Software maintenance","level":4,"score":0.2702000141143799},{"id":"https://openalex.org/C137176749","wikidata":"https://www.wikidata.org/wiki/Q4105337","display_name":"Psychological resilience","level":2,"score":0.2676999866962433},{"id":"https://openalex.org/C66429209","wikidata":"https://www.wikidata.org/wiki/Q7248499","display_name":"Programming complexity","level":5,"score":0.266400009393692},{"id":"https://openalex.org/C114869243","wikidata":"https://www.wikidata.org/wiki/Q133735","display_name":"Security through obscurity","level":5,"score":0.2623000144958496},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.2565000057220459},{"id":"https://openalex.org/C195518309","wikidata":"https://www.wikidata.org/wiki/Q13424265","display_name":"Security testing","level":5,"score":0.25029999017715454}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3786165.3788439","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3786165.3788439","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2026 IEEE/ACM 4th International Workshop on Software Vulnerability Management","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3786165.3788439","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3786165.3788439","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2026 IEEE/ACM 4th International Workshop on Software Vulnerability Management","raw_type":"proceedings-article"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.4840735197067261}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":34,"referenced_works":["https://openalex.org/W814172419","https://openalex.org/W2101105183","https://openalex.org/W2250342921","https://openalex.org/W2990685757","https://openalex.org/W3026203297","https://openalex.org/W3091588759","https://openalex.org/W3156480510","https://openalex.org/W3183469243","https://openalex.org/W3184339106","https://openalex.org/W4312045555","https://openalex.org/W4378942602","https://openalex.org/W4384345694","https://openalex.org/W4386081573","https://openalex.org/W4387298393","https://openalex.org/W4388483128","https://openalex.org/W4389524484","https://openalex.org/W4390572759","https://openalex.org/W4391136507","https://openalex.org/W4391376361","https://openalex.org/W4391558585","https://openalex.org/W4391855109","https://openalex.org/W4392414327","https://openalex.org/W4393406994","https://openalex.org/W4398785927","https://openalex.org/W4402264467","https://openalex.org/W4402393484","https://openalex.org/W4402594804","https://openalex.org/W4403182498","https://openalex.org/W4403318507","https://openalex.org/W4405543707","https://openalex.org/W4406754405","https://openalex.org/W4411552261","https://openalex.org/W4412605456","https://openalex.org/W6929620603"],"related_works":[],"abstract_inverted_index":{"Context:":[0],"Traditional":[1],"software":[2,48,174],"security":[3,49,175],"analysis":[4],"methods":[5],"struggle":[6],"to":[7,21,45,168],"keep":[8],"pace":[9],"with":[10],"the":[11,35,56,76,152,155,169,172,179],"scale":[12],"and":[13,24,29,39,58,62,84,96,104,117,123,131,149],"complexity":[14,60],"of":[15,37,68,75,154,171,181],"modern":[16],"codebases,":[17],"requiring":[18],"intelligent":[19],"automation":[20],"detect,":[22],"assess,":[23],"remediate":[25],"vulnerabilities":[26],"more":[27],"efficiently":[28],"accurately.":[30],"Objective:":[31],"This":[32],"paper":[33],"explores":[34],"incorporation":[36],"code-specific":[38],"general-purpose":[40,85],"Large":[41],"Language":[42],"Models":[43],"(LLMs)":[44],"automate":[46],"critical":[47],"tasks,":[50,136],"such":[51],"as":[52,65,142],"identifying":[53],"vulnerabilities,":[54],"predicting":[55],"severity":[57],"access":[59],"rate,":[61],"generating":[63],"fixes":[64],"a":[66],"proof":[67],"concept.":[69],"Method:":[70],"We":[71],"evaluate":[72],"five":[73],"pairs":[74],"most":[77],"recent":[78],"LLMs,":[79],"which":[80],"contain":[81],"both":[82,115],"code-based":[83],"open-source":[86],"models,":[87],"on":[88,134],"two":[89],"recognized":[90],"C/C++":[91],"vulnerability":[92],"datasets,":[93],"namely":[94],"Big-Vul":[95],"Vul-Repair.":[97],"Additionally,":[98],"we":[99,166],"show":[100,110],"comparisons":[101],"between":[102],"fine-tuning":[103],"prompt-based":[105],"approaches.":[106],"Results:":[107],"The":[108],"results":[109],"that":[111],"fine\u2011tuning":[112],"uniformly":[113],"outperforms":[114],"zero-shot":[116],"few\u2011shot":[118,132],"approaches":[119],"across":[120],"all":[121],"tasks":[122],"models.":[124],"Notably,":[125],"code\u2011specialized":[126],"models":[127,139],"excel":[128],"in":[129],"zero\u2011shot":[130],"settings":[133],"complex":[135],"but":[137],"general\u2011purpose":[138],"remain":[140],"nearly":[141],"effective.":[143],"Discrepancies":[144],"among":[145],"CodeBLEU,":[146],"CodeBERTScore,":[147],"BLEU,":[148],"ChrF":[150],"highlight":[151],"inadequacy":[153],"current":[156,173],"metrics":[157],"for":[158],"measuring":[159],"repair":[160],"quality.":[161],"Conclusions:":[162],"Through":[163],"this":[164],"study,":[165],"contribute":[167],"resilience":[170],"community":[176],"by":[177],"investigating":[178],"potential":[180],"advanced":[182],"LLMs.":[183]},"counts_by_year":[{"year":2026,"cited_by_count":2}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2026-05-14T00:00:00"}