{"id":"https://openalex.org/W4417047121","doi":"https://doi.org/10.3390/jcp5040110","title":"Leveraging Static Analysis for Feedback-Driven Security Patching in LLM-Generated Code","display_name":"Leveraging Static Analysis for Feedback-Driven Security Patching in LLM-Generated Code","publication_year":2025,"publication_date":"2025-12-05","ids":{"openalex":"https://openalex.org/W4417047121","doi":"https://doi.org/10.3390/jcp5040110"},"language":"en","primary_location":{"id":"doi:10.3390/jcp5040110","is_oa":true,"landing_page_url":"https://doi.org/10.3390/jcp5040110","pdf_url":"https://www.mdpi.com/2624-800X/5/4/110/pdf","source":{"id":"https://openalex.org/S4210232532","display_name":"Journal of Cybersecurity and Privacy","issn_l":"2624-800X","issn":["2624-800X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity and Privacy","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://www.mdpi.com/2624-800X/5/4/110/pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5075313337","display_name":"Kamel Alrashedy","orcid":null},"institutions":[{"id":"https://openalex.org/I130701444","display_name":"Georgia Institute of Technology","ror":"https://ror.org/01zkghx44","country_code":"US","type":"education","lineage":["https://openalex.org/I130701444"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Kamel Alrashedy","raw_affiliation_strings":["School of Interactive Computing, Georgia Institute of Technology, Atlanta, GA 30332, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Interactive Computing, Georgia Institute of Technology, Atlanta, GA 30332, USA","institution_ids":["https://openalex.org/I130701444"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5034662409","display_name":"Abdullah Aljasser","orcid":"https://orcid.org/0000-0003-1039-1730"},"institutions":[{"id":"https://openalex.org/I130701444","display_name":"Georgia Institute of Technology","ror":"https://ror.org/01zkghx44","country_code":"US","type":"education","lineage":["https://openalex.org/I130701444"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Abdullah Aljasser","raw_affiliation_strings":["School of Interactive Computing, Georgia Institute of Technology, Atlanta, GA 30332, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Interactive Computing, Georgia Institute of Technology, Atlanta, GA 30332, USA","institution_ids":["https://openalex.org/I130701444"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5051331381","display_name":"Pradyumna Tambwekar","orcid":"https://orcid.org/0000-0003-2931-2502"},"institutions":[{"id":"https://openalex.org/I130701444","display_name":"Georgia Institute of Technology","ror":"https://ror.org/01zkghx44","country_code":"US","type":"education","lineage":["https://openalex.org/I130701444"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Pradyumna Tambwekar","raw_affiliation_strings":["School of Interactive Computing, Georgia Institute of Technology, Atlanta, GA 30332, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Interactive Computing, Georgia Institute of Technology, Atlanta, GA 30332, USA","institution_ids":["https://openalex.org/I130701444"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5008211323","display_name":"Matthew Gombolay","orcid":"https://orcid.org/0000-0002-5321-6038"},"institutions":[{"id":"https://openalex.org/I130701444","display_name":"Georgia Institute of Technology","ror":"https://ror.org/01zkghx44","country_code":"US","type":"education","lineage":["https://openalex.org/I130701444"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Matthew Gombolay","raw_affiliation_strings":["School of Interactive Computing, Georgia Institute of Technology, Atlanta, GA 30332, USA"],"raw_orcid":"https://orcid.org/0000-0002-5321-6038","affiliations":[{"raw_affiliation_string":"School of Interactive Computing, Georgia Institute of Technology, Atlanta, GA 30332, USA","institution_ids":["https://openalex.org/I130701444"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5075313337"],"corresponding_institution_ids":["https://openalex.org/I130701444"],"apc_list":{"value":1000,"currency":"CHF","value_usd":1207},"apc_paid":{"value":1000,"currency":"CHF","value_usd":1207},"fwci":1.0865,"has_fulltext":true,"cited_by_count":2,"citation_normalized_percentile":{"value":0.79718838,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":97,"max":98},"biblio":{"volume":"5","issue":"4","first_page":"110","last_page":"110"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.3497999906539917,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.3497999906539917,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.2831000089645386,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.10689999908208847,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/static-analysis","display_name":"Static analysis","score":0.7871000170707703},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.7462999820709229},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.5665000081062317},{"id":"https://openalex.org/keywords/field","display_name":"Field (mathematics)","score":0.5421000123023987},{"id":"https://openalex.org/keywords/static-program-analysis","display_name":"Static program analysis","score":0.5123999714851379},{"id":"https://openalex.org/keywords/source-code","display_name":"Source code","score":0.3953000009059906},{"id":"https://openalex.org/keywords/security-analysis","display_name":"Security analysis","score":0.38670000433921814},{"id":"https://openalex.org/keywords/code-generation","display_name":"Code generation","score":0.36559998989105225}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7964000105857849},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.7871000170707703},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.7462999820709229},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.5665000081062317},{"id":"https://openalex.org/C9652623","wikidata":"https://www.wikidata.org/wiki/Q190109","display_name":"Field (mathematics)","level":2,"score":0.5421000123023987},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5414000153541565},{"id":"https://openalex.org/C137287247","wikidata":"https://www.wikidata.org/wiki/Q1329550","display_name":"Static program analysis","level":4,"score":0.5123999714851379},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.3993000090122223},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.3953000009059906},{"id":"https://openalex.org/C38369872","wikidata":"https://www.wikidata.org/wiki/Q7445009","display_name":"Security analysis","level":2,"score":0.38670000433921814},{"id":"https://openalex.org/C133162039","wikidata":"https://www.wikidata.org/wiki/Q1061077","display_name":"Code generation","level":3,"score":0.36559998989105225},{"id":"https://openalex.org/C121822524","wikidata":"https://www.wikidata.org/wiki/Q5157582","display_name":"Computer security model","level":2,"score":0.33899998664855957},{"id":"https://openalex.org/C77109596","wikidata":"https://www.wikidata.org/wiki/Q4781497","display_name":"Application security","level":5,"score":0.33709999918937683},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.32899999618530273},{"id":"https://openalex.org/C22680326","wikidata":"https://www.wikidata.org/wiki/Q7444867","display_name":"Secure coding","level":5,"score":0.3160000145435333},{"id":"https://openalex.org/C98183937","wikidata":"https://www.wikidata.org/wiki/Q2112188","display_name":"Program analysis","level":2,"score":0.3019999861717224},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.2786000072956085},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.25999999046325684},{"id":"https://openalex.org/C154908896","wikidata":"https://www.wikidata.org/wiki/Q2167404","display_name":"Security policy","level":2,"score":0.2581999897956848},{"id":"https://openalex.org/C63116202","wikidata":"https://www.wikidata.org/wiki/Q7676227","display_name":"Taint checking","level":3,"score":0.2563000023365021},{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.25609999895095825},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.2549000084400177}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.3390/jcp5040110","is_oa":true,"landing_page_url":"https://doi.org/10.3390/jcp5040110","pdf_url":"https://www.mdpi.com/2624-800X/5/4/110/pdf","source":{"id":"https://openalex.org/S4210232532","display_name":"Journal of Cybersecurity and Privacy","issn_l":"2624-800X","issn":["2624-800X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity and Privacy","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:a94870887603432bb2916b0029313b03","is_oa":true,"landing_page_url":"https://doaj.org/article/a94870887603432bb2916b0029313b03","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Journal of Cybersecurity and Privacy, Vol 5, Iss 4, p 110 (2025)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.3390/jcp5040110","is_oa":true,"landing_page_url":"https://doi.org/10.3390/jcp5040110","pdf_url":"https://www.mdpi.com/2624-800X/5/4/110/pdf","source":{"id":"https://openalex.org/S4210232532","display_name":"Journal of Cybersecurity and Privacy","issn_l":"2624-800X","issn":["2624-800X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity and Privacy","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320335743","display_name":"Saudi Arabian Cultural Mission","ror":null}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4417047121.pdf","grobid_xml":"https://content.openalex.org/works/W4417047121.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Large":[0],"language":[1],"models":[2,14],"(LLMs)":[3],"have":[4],"shown":[5],"remarkable":[6],"potential":[7,78],"for":[8],"automatic":[9,66],"code":[10,24,68,81,98],"generation.":[11],"Yet,":[12],"these":[13],"share":[15],"a":[16,61,86],"weakness":[17],"with":[18,25,127,131],"their":[19],"human":[20],"counterparts:":[21],"inadvertently":[22],"generating":[23],"security":[26],"vulnerabilities":[27,120],"that":[28,64,90],"could":[29],"allow":[30],"unauthorized":[31],"attackers":[32],"to":[33,57,70,74,80,123],"access":[34],"sensitive":[35],"data":[36],"or":[37],"systems.":[38,110],"In":[39],"this":[40],"work,":[41],"we":[42,84],"propose":[43],"Feedback-Driven":[44],"Security":[45],"Patching":[46],"(FDSP),":[47],"wherein":[48],"LLMs":[49],"automatically":[50],"refine":[51],"vulnerable":[52],"generated":[53],"code.":[54],"The":[55],"key":[56],"our":[58],"approach":[59,114],"is":[60],"unique":[62],"framework":[63],"leverages":[65],"static":[67],"analysis":[69],"enable":[71],"the":[72,95,116],"LLM":[73],"create":[75],"and":[76,108,129,133],"implement":[77],"solutions":[79],"vulnerabilities.":[82],"Further,":[83],"curate":[85],"novel":[87],"benchmark,":[88],"PythonSecurityEval,":[89],"can":[91],"accelerate":[92],"progress":[93],"in":[94],"field":[96],"of":[97],"generation":[99],"by":[100,121],"covering":[101],"diverse,":[102],"real-world":[103],"applications,":[104],"including":[105],"databases,":[106],"websites,":[107],"operating":[109],"Our":[111],"proposed":[112],"FDSP":[113],"achieves":[115],"strongest":[117],"improvements,":[118],"reducing":[119],"up":[122],"33%":[124],"when":[125],"evaluated":[126],"Bandit":[128],"12%":[130],"CodeQL":[132],"outperforming":[134],"baseline":[135],"refinement":[136],"methods.":[137]},"counts_by_year":[{"year":2026,"cited_by_count":2}],"updated_date":"2026-08-23T07:36:19.812096","created_date":"2025-12-05T00:00:00"}