{"id":"https://openalex.org/W7167633952","doi":"https://doi.org/10.1145/3786181.3788722","title":"RAG Against the Machine: Zero-Shot Software Vulnerabilities Classification using LLMs","display_name":"RAG Against the Machine: Zero-Shot Software Vulnerabilities Classification using LLMs","publication_year":2026,"publication_date":"2026-04-12","ids":{"openalex":"https://openalex.org/W7167633952","doi":"https://doi.org/10.1145/3786181.3788722"},"language":null,"primary_location":{"id":"doi:10.1145/3786181.3788722","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3786181.3788722","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 3rd International Workshop on Large Language Models For Code","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1145/3786181.3788722","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5128125919","display_name":"Edvin Nordqvist","orcid":null},"institutions":[{"id":"https://openalex.org/I86987016","display_name":"KTH Royal Institute of Technology","ror":"https://ror.org/026vcq606","country_code":"SE","type":"education","lineage":["https://openalex.org/I86987016"]}],"countries":["SE"],"is_corresponding":false,"raw_author_name":"Edvin Nordqvist","raw_affiliation_strings":["KTH Royal Institute of Technology, Stockholm, Sweden"],"raw_orcid":"https://orcid.org/0009-0009-2019-2672","affiliations":[{"raw_affiliation_string":"KTH Royal Institute of Technology, Stockholm, Sweden","institution_ids":["https://openalex.org/I86987016"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5071865765","display_name":"Changjie Wang","orcid":"https://orcid.org/0009-0000-4604-1180"},"institutions":[{"id":"https://openalex.org/I86987016","display_name":"KTH Royal Institute of Technology","ror":"https://ror.org/026vcq606","country_code":"SE","type":"education","lineage":["https://openalex.org/I86987016"]}],"countries":["SE"],"is_corresponding":false,"raw_author_name":"Changjie Wang","raw_affiliation_strings":["KTH Royal Institute of Technology, Stockholm, Sweden"],"raw_orcid":"https://orcid.org/0009-0000-4604-1180","affiliations":[{"raw_affiliation_string":"KTH Royal Institute of Technology, Stockholm, Sweden","institution_ids":["https://openalex.org/I86987016"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5019583021","display_name":"Simone Ferlin","orcid":"https://orcid.org/0000-0002-0722-2656"},"institutions":[{"id":"https://openalex.org/I1328219102","display_name":"Red Hat (United States)","ror":"https://ror.org/03ncs3316","country_code":"US","type":"company","lineage":["https://openalex.org/I1328219102"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Simone Ferlin","raw_affiliation_strings":["Red Hat, Raleigh, North Carolina, USA"],"raw_orcid":"https://orcid.org/0000-0002-0722-2656","affiliations":[{"raw_affiliation_string":"Red Hat, Raleigh, North Carolina, USA","institution_ids":["https://openalex.org/I1328219102"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5089462139","display_name":"Mariano Scazzariello","orcid":"https://orcid.org/0000-0002-9780-873X"},"institutions":[{"id":"https://openalex.org/I2800664555","display_name":"RISE Research Institutes of Sweden","ror":"https://ror.org/03nnxqz81","country_code":"SE","type":"other","lineage":["https://openalex.org/I2800664555"]}],"countries":["SE"],"is_corresponding":false,"raw_author_name":"Mariano Scazzariello","raw_affiliation_strings":["RISE Research Institutes of Sweden, Stockholm, Sweden"],"raw_orcid":"https://orcid.org/0000-0002-9780-873X","affiliations":[{"raw_affiliation_string":"RISE Research Institutes of Sweden, Stockholm, Sweden","institution_ids":["https://openalex.org/I2800664555"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5058517041","display_name":"Marco Chiesa","orcid":"https://orcid.org/0000-0002-9675-9729"},"institutions":[{"id":"https://openalex.org/I86987016","display_name":"KTH Royal Institute of Technology","ror":"https://ror.org/026vcq606","country_code":"SE","type":"education","lineage":["https://openalex.org/I86987016"]}],"countries":["SE"],"is_corresponding":false,"raw_author_name":"Marco Chiesa","raw_affiliation_strings":["KTH Royal Institute of Technology, Stockholm, Sweden"],"raw_orcid":"https://orcid.org/0000-0002-9675-9729","affiliations":[{"raw_affiliation_string":"KTH Royal Institute of Technology, Stockholm, Sweden","institution_ids":["https://openalex.org/I86987016"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.94950366,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"184","last_page":"191"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.38199999928474426,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.38199999928474426,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.22990000247955322,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.11590000241994858,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/vulnerability-management","display_name":"Vulnerability management","score":0.7300999760627747},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.7069000005722046},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.5562000274658203},{"id":"https://openalex.org/keywords/categorization","display_name":"Categorization","score":0.5113000273704529},{"id":"https://openalex.org/keywords/software-security-assurance","display_name":"Software security assurance","score":0.49480000138282776},{"id":"https://openalex.org/keywords/pipeline","display_name":"Pipeline (software)","score":0.48660001158714294},{"id":"https://openalex.org/keywords/vulnerability-assessment","display_name":"Vulnerability assessment","score":0.4562999904155731}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7301999926567078},{"id":"https://openalex.org/C172776598","wikidata":"https://www.wikidata.org/wiki/Q7943570","display_name":"Vulnerability management","level":4,"score":0.7300999760627747},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.7069000005722046},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.5562000274658203},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5543000102043152},{"id":"https://openalex.org/C94124525","wikidata":"https://www.wikidata.org/wiki/Q912550","display_name":"Categorization","level":2,"score":0.5113000273704529},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.49480000138282776},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.48660001158714294},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.4562999904155731},{"id":"https://openalex.org/C22680326","wikidata":"https://www.wikidata.org/wiki/Q7444867","display_name":"Secure coding","level":5,"score":0.43630000948905945},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.3919999897480011},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.3677999973297119},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.359499990940094},{"id":"https://openalex.org/C32896092","wikidata":"https://www.wikidata.org/wiki/Q189447","display_name":"Risk management","level":2,"score":0.3253999948501587},{"id":"https://openalex.org/C12174686","wikidata":"https://www.wikidata.org/wiki/Q1058438","display_name":"Risk assessment","level":2,"score":0.325300008058548},{"id":"https://openalex.org/C191267431","wikidata":"https://www.wikidata.org/wiki/Q911932","display_name":"Honeypot","level":2,"score":0.2858999967575073},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.2784000039100647},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2743000090122223},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.27160000801086426},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.2648000121116638},{"id":"https://openalex.org/C83163435","wikidata":"https://www.wikidata.org/wiki/Q3954104","display_name":"Security management","level":2,"score":0.26260000467300415}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3786181.3788722","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3786181.3788722","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 3rd International Workshop on Large Language Models For Code","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3786181.3788722","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3786181.3788722","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 3rd International Workshop on Large Language Models For Code","raw_type":"proceedings-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/12","score":0.44061100482940674,"display_name":"Responsible consumption and production"}],"awards":[{"id":"https://openalex.org/G2725416508","display_name":null,"funder_award_id":"2021-04212","funder_id":"https://openalex.org/F4320321030","funder_display_name":"VINNOVA"}],"funders":[{"id":"https://openalex.org/F4320321030","display_name":"VINNOVA","ror":"https://ror.org/01kd5m353"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":15,"referenced_works":["https://openalex.org/W2006187024","https://openalex.org/W2538706977","https://openalex.org/W3093734859","https://openalex.org/W3112944441","https://openalex.org/W3210162706","https://openalex.org/W4243650394","https://openalex.org/W4295857769","https://openalex.org/W4386336981","https://openalex.org/W4391463108","https://openalex.org/W4393029443","https://openalex.org/W4393208022","https://openalex.org/W4399203251","https://openalex.org/W4400577004","https://openalex.org/W4402218089","https://openalex.org/W4411233007"],"related_works":[],"abstract_inverted_index":{"Timely":[0],"detection":[1],"and":[2,74,93,103,136,147,166],"mitigation":[3],"of":[4,158,168],"software":[5,173],"vulnerabilities":[6,23],"is":[7],"essential":[8],"for":[9,65,90],"maintaining":[10],"secure":[11],"systems.":[12],"While":[13],"recent":[14],"research":[15],"has":[16],"applied":[17],"Transformer-based":[18],"models":[19],"to":[20,44,49,99,115,141,161],"automatically":[21],"identify":[22],"from":[24],"sources":[25],"such":[26],"as":[27],"GitHub":[28],"issues,":[29,46],"these":[30],"approaches":[31,160],"do":[32],"not":[33],"classify":[34],"the":[35,79,131,143,150,156,163,172],"detected":[36],"vulnerabilities.":[37],"Without":[38],"systematic":[39],"classification,":[40,139],"it":[41],"becomes":[42],"difficult":[43],"prioritize":[45],"link":[47],"them":[48,54],"remediation":[50,148],"strategies,":[51],"or":[52],"integrate":[53],"into":[55],"broader":[56],"security":[57],"workflows.":[58],"This":[59,153],"paper":[60],"introduces":[61],"a":[62,87,123],"novel":[63],"approach":[64,110],"automated":[66],"vulnerability":[67,138,151,169],"categorization":[68],"using":[69],"Large":[70],"Language":[71],"Models":[72],"(LLMs)":[73],"Retrieval-Augmented":[75],"Generation":[76],"(RAG)":[77],"within":[78],"Common":[80],"Weakness":[81],"Enumeration":[82],"(CWE)":[83],"framework.":[84],"We":[85],"present":[86],"RAG-based":[88],"pipeline":[89],"CWE":[91],"labeling":[92],"systematically":[94],"evaluate":[95],"multiple":[96],"retrieval":[97],"strategies":[98],"assess":[100],"their":[101],"effectiveness":[102],"efficiency.":[104],"The":[105],"results":[106],"demonstrate":[107],"that":[108],"our":[109],"achieves":[111],"competitive":[112],"performance":[113],"compared":[114],"prior":[116],"state-of-the-art":[117],"methods,":[118],"despite":[119],"operating":[120],"entirely":[121],"in":[122,149],"zero-shot":[124],"setting":[125],"without":[126],"any":[127],"task-specific":[128],"training.":[129],"Moreover,":[130],"proposed":[132],"method":[133],"enables":[134],"accurate":[135],"cost-effective":[137],"helping":[140],"reduce":[142],"gap":[144],"between":[145],"discovery":[146],"lifecycle.":[152],"work":[154],"highlights":[155],"potential":[157],"retrieval-driven":[159],"enhance":[162],"automation,":[164],"scalability,":[165],"practicality":[167],"management":[170],"across":[171],"ecosystem.":[174]},"counts_by_year":[],"updated_date":"2026-07-08T06:22:20.291053","created_date":"2026-07-08T00:00:00"}