Reproduce “Bridging Code Property Graphs and Language Models for Program Analysis” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
Ahmed Lekssays
The `codebadger` framework allows Large Language Models to perform scalable and semantically deep program analysis for software vulnerability management by integrating Joern's Code Property Graph (CPG) engine. It provides LLMs with high-level analysis tools, enabling them to overcome token limits and analyze inter-procedural vulnerabilities in large codebases, successfully identifying a new zero-day vulnerability in libtiff and proposing a correct patch for a CVE in libxml2.
Key insights
- Abstracting complex static analysis operations into high-level tools enables LLMs to perform deep semantic code understanding without needing to generate intricate CPGQL queries directly.
- Targeted, semantic exploration via CPGs allows LLMs to overcome token limits, enabling comprehensive program analysis across large repositories by focusing on relevant code paths.
- The integration facilitates robust agentic LLM workflows, enhancing vulnerability discovery and patching capabilities by providing access to inter-procedural data flows and control dependencies.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.