Boosting Cybersecurity Vulnerability Scanning based on LLM-supported Static Application Security Testing

TL;DR

LSAST is proposed, a novel approach that integrates LLMs with SAST scanners to enhance vulnerability detection and set a new benchmark for static vulnerability analysis, offering a robust, privacy-conscious solution that bridges the gap between traditional scanners and advanced AI-driven analysis.

Abstract

The current cybersecurity landscape is increasingly complex, with traditional Static Application Security Testing (SAST) tools struggling to capture complex and emerging vulnerabilities due to their reliance on rule-based matching. Meanwhile, Large Language Models (LLMs) have demonstrated powerful code analysis capabilities, but their static training data and privacy risks limit their effectiveness. To overcome the limitations of both approaches, we propose LSAST, a novel approach that integrates LLMs with SAST scanners to enhance vulnerability detection. LSAST leverages a locally hostable LLM, combined with a state-of-the-art knowledge retrieval system, to provide up-to-date vulnerability insights without compromising data privacy. We set a new benchmark for static vulnerability analysis, offering a robust, privacy-conscious solution that bridges the gap between traditional scanners and advanced AI-driven analysis. Our evaluation demonstrates that incorporating SAST results into LLM analysis significantly improves detection accuracy, identifying vulnerabilities missed by conventional methods.

Figures (8)

• Figure 1: Own-Knowledge Approach RAW
• Figure 2: Own-Knowledge Approach LSAST
• Figure 3: Functionality Approach RAW
• Figure 4: Functionality Approach LSAST
• Figure 5: Abstraction Approach RAW