{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,22]],"date-time":"2026-09-22T00:02:31Z","timestamp":1790035351877,"version":"4.0.1"},"reference-count":58,"publisher":"Springer Science and Business Media LLC","issue":"4","license":[{"start":{"date-parts":[[2026,9,22]],"date-time":"2026-09-22T00:00:00Z","timestamp":1790035200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2026,9,22]],"date-time":"2026-09-22T00:00:00Z","timestamp":1790035200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Autom Softw Eng"],"published-print":{"date-parts":[[2026,12]]},"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>Dockerfiles are a widely adopted format for specifying Infrastructure-as-Code (IaC). However, insecure or misconfigured Dockerfiles frequently introduce critical security smells, including improper privilege use, unpinned dependencies, and secret leakage. State-of-practice tools such as Hadolint, Checkov, and KICS rely on static rules and regular expressions, leading to high false-negative rates and limited explanations for developers\u2014particularly when security smells are semantically interwoven into configuration logic. We present an LLM-based framework that integrates (i) a fine-tuned multi-label risk detector trained on 4,000 manually annotated Dockerfiles across ten high-impact categories, and (ii) a retrieval-augmented interpretation-and-repair module that outputs both human-readable rationales and corrected code. The system is deployed via a VSCode plugin for real-time support. Experiments on a curated test set show that the detector achieves a macro-averaged precision of 0.97 and recall of 0.94, improving recall by 9\u201328 percentage points over static baselines. A user study further confirms the usability of our approach, demonstrating significant improvements in risk comprehension, identification accuracy, and remediation effort. Our findings highlight the feasibility of LLM-assisted IaC security and provide practical early mitigation for Dockerfile misconfigurations.<\/jats:p>","DOI":"10.1007\/s10515-026-00684-z","type":"journal-article","created":{"date-parts":[[2026,9,21]],"date-time":"2026-09-21T23:16:27Z","timestamp":1790032587000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Security smell detection in Dockerfiles"],"prefix":"10.1007","volume":"33","author":[{"given":"Wenbo","family":"Zhang","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5357-0945","authenticated-orcid":false,"given":"Inah","family":"Omoronyia","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2026,9,22]]},"reference":[{"key":"684_CR1","unstructured":"Aquasecurity: trivy-checks\/checks\/docker at main \u00b7 aquasecurity\/trivy-checks (2023). https:\/\/github.com\/aquasecurity\/trivy-checks\/tree\/main\/checks\/docker. Accessed 2025-07-01"},{"key":"684_CR2","doi-asserted-by":"publisher","unstructured":"Authors, A.: docker-dataset. Zenodo (CERN European Organization for Nuclear Research) (2020). https:\/\/doi.org\/10.5281\/zenodo.3862987. Accessed 01 July 2025","DOI":"10.5281\/zenodo.3862987"},{"key":"684_CR3","unstructured":"Barroso, S.: Code Smell Detection in Infrastructure as Code using Transformers (2023). https:\/\/fenix.tecnico.ulisboa.pt\/downloadFile\/563345090421856\/92557-sancha-barroso.pdf"},{"key":"684_CR4","doi-asserted-by":"crossref","unstructured":"Begoug, M., Chouchen, M., Ouni, A., AlOmar, E.A., Mkaouer, M.W.: Fine-grained just-in-time defect prediction at the block level in infrastructure-as-code (iac). In: 2024 IEEE\/ACM 21st International Conference on Mining Software Repositories (MSR), pp. 100\u2013112 (2024)","DOI":"10.1145\/3643991.3644934"},{"key":"684_CR5","doi-asserted-by":"crossref","unstructured":"Borovits, N., Kumara, I., Krishnan, P., Palma, S.D., Nucci, D.D., Palomba, F., Tamburri, D.A., Heuvel, W.-J.: DeepIaC: Deep Learning-Based Linguistic Anti-pattern Detection in IaC (2020). arxiv.org\/abs\/2009.10801","DOI":"10.1145\/3416505.3423564"},{"key":"684_CR6","doi-asserted-by":"publisher","unstructured":"Borovits, N., Kumara, I., Di\u00a0Nucci, D., Krishnan, P., Palma, S.D., Palomba, F., Tamburri, D.A., Heuvel, W.-J.v.d.: Findici: Using machine learning to detect linguistic inconsistencies between code and natural language descriptions in infrastructure-as-code. Empirical Softw. Engg. 27(7) (2022). https:\/\/doi.org\/10.1007\/s10664-022-10215-5","DOI":"10.1007\/s10664-022-10215-5"},{"key":"684_CR7","doi-asserted-by":"publisher","unstructured":"Bose, D.B., Rahman, A., Shamim, S.I.: \u2018under-reported\u2019 security defects in kubernetes manifests. In: 2021 IEEE\/ACM 2nd International Workshop on Engineering and Cybersecurity of Critical Systems (EnCyCriS), pp. 9\u201312 (2021). https:\/\/doi.org\/10.1109\/EnCyCriS52570.2021.00009","DOI":"10.1109\/EnCyCriS52570.2021.00009"},{"key":"684_CR8","doi-asserted-by":"crossref","unstructured":"Catolino, G., Palomba, F., Zaidman, A., Ferrucci, F.: Not All Bugs Are the Same: Understanding, Characterizing, and Classifying the Root Cause of Bugs (2019). arxiv.org\/abs\/1907.11031","DOI":"10.1016\/j.jss.2019.03.002"},{"key":"684_CR9","unstructured":"Checkmarx: kics\/assets\/queries\/dockerfile at master \u00b7 Checkmarx\/kics (2020). https:\/\/github.com\/Checkmarx\/kics\/tree\/master\/assets\/queries\/dockerfile Accessed 2025-07-01"},{"key":"684_CR10","doi-asserted-by":"publisher","unstructured":"Cheng, X., Wang, H., Hua, J., Xu, G., Sui, Y.: Deepwukong: Statically detecting software vulnerabilities using deep graph neural network. ACM Trans. Softw. Eng. Methodol. 30(3) (2021). https:\/\/doi.org\/10.1145\/3436877","DOI":"10.1145\/3436877"},{"key":"684_CR11","unstructured":"Chroma, v.: Getting Started - Chroma Docs (2025). https:\/\/docs.trychroma.com\/docs\/overview\/getting-started"},{"key":"684_CR12","unstructured":"Contributors, W.: Regular expression. Wikimedia Foundation (2019). https:\/\/en.wikipedia.org\/wiki\/Regular_expression"},{"issue":"6","key":"684_CR13","doi-asserted-by":"publisher","first-page":"2086","DOI":"10.1109\/TSE.2021.3051492","volume":"48","author":"S Dalla Palma","year":"2022","unstructured":"Dalla Palma, S., Di Nucci, D., Palomba, F., Tamburri, D.A.: Within-project defect prediction of infrastructure-as-code using product and process metrics. IEEE Trans. Softw. Eng. 48(6), 2086\u20132104 (2022). https:\/\/doi.org\/10.1109\/TSE.2021.3051492","journal-title":"IEEE Trans. Softw. Eng."},{"key":"684_CR14","doi-asserted-by":"crossref","unstructured":"Dettmers, T., Pagnoni, A., Holtzman, A., Zettlemoyer, L.: QLoRA: Efficient Finetuning of Quantized LLMs (2023). arxiv.org\/abs\/2305.14314","DOI":"10.52202\/075280-0441"},{"key":"684_CR15","doi-asserted-by":"crossref","unstructured":"Ferrag, M.A., Battah, A., Tihanyi, N., Jain, R., Maimut, D., Alwahedi, F., Lestable, T., Thandi, N.S., Mechri, A., Debbah, M., Cordeiro, L.C.: SecureFalcon: Are We There Yet in Automated Software Vulnerability Detection with LLMs? (2025). arxiv.org\/abs\/2307.06616","DOI":"10.1109\/TSE.2025.3548168"},{"key":"684_CR16","unstructured":"Gao, Y., Xiong, Y., Gao, X., Jia, K., Pan, J., Bi, Y., Dai, Y., Sun, J., Wang, M., Wang, H.: Retrieval-Augmented Generation for Large Language Models: A Survey (2024). arxiv.org\/abs\/2312.10997"},{"key":"684_CR17","unstructured":"Github, C.: bridgecrewio\/checkov (2024). https:\/\/github.com\/bridgecrewio\/checkov"},{"key":"684_CR18","unstructured":"GrayHatWarfare: GrayHatWarfare Public Buckets Search (2025). Accessed 07 Oct 2025. https:\/\/buckets.grayhatwarfare.com"},{"key":"684_CR19","unstructured":"Hadolint: GitHub - hadolint\/hadolint: Dockerfile linter, validate inline bash, written in Haskell (2022). https:\/\/github.com\/hadolint\/hadolint"},{"key":"684_CR20","unstructured":"Hadolint: Home (2024). https:\/\/github.com\/hadolint\/hadolint\/wiki. Accessed 01 July 2025"},{"key":"684_CR21","doi-asserted-by":"publisher","unstructured":"Henkel, J., Bird, C., Lahiri, S.K., Reps, T.: Learning from, understanding, and supporting devops artifacts for docker. In: Proceedings of the ACM\/IEEE 42nd International Conference on Software Engineering. ICSE \u201920, pp. 38\u201349. ACM (2020). https:\/\/doi.org\/10.1145\/3377811.3380406","DOI":"10.1145\/3377811.3380406"},{"key":"684_CR22","unstructured":"Hu, E.J., Shen, Y., Wallis, P., Allen-Zhu, Z., Li, Y., Wang, S., Wang, L., Chen, W.: LoRA: Low-Rank Adaptation of Large Language Models (2021). arxiv.org\/abs\/2106.09685"},{"key":"684_CR23","unstructured":"Jjhenkel: GitHub - jjhenkel\/binnacle-icse2020: ICSE 2020 Artifact for: Learning from, Understanding, and Supporting DevOps Artifacts for Docker (2020). https:\/\/github.com\/jjhenkel\/binnacle-icse2020\/tree\/master. Accessed 01 July 2025"},{"key":"684_CR24","unstructured":"Kunert, P.: More UK councils caught by Capita\u2019s open AWS bucket blunder. The Register (2023). https:\/\/www.theregister.com\/2023\/05\/22\/capita_security_pensions_aws_bucket_city_councils\/. Accessed 07 June 2025"},{"key":"684_CR25","unstructured":"Label\u00a0Studio, D.: Label Studio Documentation (2025). https:\/\/labelstud.io\/guide. Accessed 01 July 2025"},{"key":"684_CR26","unstructured":"LeakIX: LeakIX: Public Exposure Search Engine (2025). Accessed 07 Oct 2025. https:\/\/leakix.net"},{"key":"684_CR27","unstructured":"Loshchilov, I., Hutter, F.: SGDR: Stochastic Gradient Descent with Warm Restarts (2017). arxiv.org\/abs\/1608.03983"},{"key":"684_CR28","unstructured":"Loshchilov, I., Hutter, F.: Decoupled Weight Decay Regularization (2019). arxiv.org\/abs\/1711.05101"},{"key":"684_CR29","unstructured":"Malul, E., Meidan, Y., Mimran, D., Elovici, Y., Shabtai, A.: GenKubeSec: LLM-Based Kubernetes Misconfiguration Detection, Localization, Reasoning, and Remediation (2024). arxiv.org\/abs\/2405.19954"},{"key":"684_CR30","unstructured":"Media, A.: Risk Management Lifecycle: 5 Steps to a Safer, More Resilient Organization (2023). https:\/\/www.alertmedia.com\/blog\/risk-management-lifecycle\/"},{"key":"684_CR31","unstructured":"Official, b.p.: Building best practices (2024). https:\/\/docs.docker.com\/build\/building\/best-practices\/"},{"key":"684_CR32","doi-asserted-by":"publisher","unstructured":"Opdebeeck, R., Zerouali, A., De\u00a0Roover, C.: Control and data flow in security smell detection for infrastructure as code: Is it worth the effort? In: 2023 IEEE\/ACM 20th International Conference on Mining Software Repositories (MSR), pp. 534\u2013545 (2023). https:\/\/doi.org\/10.1109\/MSR59073.2023.00079","DOI":"10.1109\/MSR59073.2023.00079"},{"key":"684_CR33","unstructured":"OWASP: Docker Security - OWASP Cheat Sheet Series. https:\/\/cheatsheetseries.owasp.org\/cheatsheets\/Docker_Security_Cheat_Sheet.html"},{"key":"684_CR34","unstructured":"OWASP: OWASP Top Ten. OWASP (2021). https:\/\/owasp.org\/www-project-top-ten\/"},{"key":"684_CR35","unstructured":"Practise, D.: Building best practices (2024). https:\/\/docs.docker.com\/build\/building\/best-practices\/"},{"key":"684_CR36","unstructured":"PwC Nigeria tech bootcamp IDs exposed | Cybernews (2023). https:\/\/cybernews.com\/security\/pwc-nigeria-tech-bootcamp-ids-exposed\/. Accessed 07 June 2025"},{"key":"684_CR37","unstructured":"Qwen, D.: Quickstart - Qwen (2024). https:\/\/qwen.readthedocs.io\/en\/latest\/getting_started\/quickstart.html"},{"key":"684_CR38","unstructured":"Qwen, T.: Qwen3: Think Deeper, Act Faster (2025). https:\/\/qwenlm.github.io\/blog\/qwen3\/"},{"key":"684_CR39","unstructured":"QwenLM: GitHub - QwenLM\/Qwen2.5-Coder: Qwen2.5-Coder is the code version of Qwen2.5, the large language model series developed by Qwen team, Alibaba Cloud (2024). https:\/\/github.com\/QwenLM\/Qwen2.5-Coder"},{"key":"684_CR40","doi-asserted-by":"publisher","unstructured":"Rahman, A., Parnin, C., Williams, L.: The seven sins: Security smells in infrastructure as code scripts. In: 2019 IEEE\/ACM 41st International Conference on Software Engineering (ICSE), pp. 164\u2013175 (2019). https:\/\/doi.org\/10.1109\/ICSE.2019.00033","DOI":"10.1109\/ICSE.2019.00033"},{"key":"684_CR41","unstructured":"Rahman, A., Rahman, M.R., Parnin, C., Williams, L.: Security Smells in Ansible and Chef Scripts: A Replication Study (2020). arxiv.org\/abs\/1907.07159"},{"key":"684_CR42","doi-asserted-by":"publisher","unstructured":"Rahman, A., Shamim, S.I., Bose, D.B., Pandita, R.: Security misconfigurations in open source kubernetes manifests: An empirical study. ACM Trans. Softw. Eng. Methodol. 32(4) (2023). https:\/\/doi.org\/10.1145\/3579639","DOI":"10.1145\/3579639"},{"key":"684_CR43","doi-asserted-by":"publisher","unstructured":"Reddy\u00a0Konala, P.R., Kumar, V., Bainbridge, D.: Sok: Static configuration analysis in infrastructure as code scripts. In: 2023 IEEE International Conference on Cyber Security and Resilience (CSR), pp. 281\u2013288 (2023). https:\/\/doi.org\/10.1109\/CSR57506.2023.10224925","DOI":"10.1109\/CSR57506.2023.10224925"},{"key":"684_CR44","unstructured":"Refactoring: Improving the Design of Existing Code, Addison-Wesley Longman Publishing Co., Inc (1999)"},{"key":"684_CR45","unstructured":"Rosa, G., Scalabrino, S., Oliveto, R.: Fixing Dockerfile Smells: An Empirical Study (2022). arxiv.org\/abs\/2208.09097"},{"key":"684_CR46","doi-asserted-by":"crossref","unstructured":"Saavedra, N., Ferreira, J.F.: GLITCH: Automated Polyglot Security Smell Detection in Infrastructure as Code (2022). arxiv.org\/abs\/2205.14371","DOI":"10.1145\/3551349.3556945"},{"key":"684_CR47","doi-asserted-by":"crossref","unstructured":"Sadik, A.R., Govind, S.: Benchmarking LLM for Code Smells Detection: OpenAI GPT-4.0 vs DeepSeek-V3 (2025). arxiv.org\/abs\/2504.16027","DOI":"10.1145\/3756681.3756993"},{"key":"684_CR48","unstructured":"Sonar: the home of clean code. https:\/\/www.sonarsource.com\/products\/sonarqube\/"},{"key":"684_CR49","unstructured":"Srivatsa, K.G., Mukhopadhyay, S., Katrapati, G., Shrivastava, M.: A Survey of using Large Language Models for Generating Infrastructure as Code (2024). arxiv.org\/abs\/2404.00227"},{"key":"684_CR50","unstructured":"standard, b.: CIS Docker Benchmarks. https:\/\/www.cisecurity.org\/benchmark\/docker"},{"key":"684_CR51","unstructured":"Tenable: terrascan\/pkg\/policies\/opa\/rego\/docker at master \u00b7 tenable\/terrascan (2017). https:\/\/github.com\/tenable\/terrascan\/tree\/master\/pkg\/policies\/opa\/rego\/docker. Accessed 01 July 2025"},{"key":"684_CR52","unstructured":"Tool, T.: tenable\/terrascan (2022). https:\/\/github.com\/tenable\/terrascan"},{"key":"684_CR53","unstructured":"Tool, K.: KICS - Keeping Infrastructure as Code Secure. https:\/\/kics.io\/index.html"},{"key":"684_CR54","unstructured":"Website, S.: Technology | 2024 Stack Overflow Developer Survey (2024). https:\/\/survey.stackoverflow.co\/2024\/technology#most-popular-technologies-tools-tech-prof"},{"key":"684_CR55","doi-asserted-by":"publisher","unstructured":"Wu, Y., Zhang, Y., Wang, T., Wang, H.: Characterizing the occurrence of dockerfile smells in open-source software: An empirical study. IEEE Access. 8, 34127\u201334139 (2020). https:\/\/doi.org\/10.1109\/ACCESS.2020.2973750","DOI":"10.1109\/ACCESS.2020.2973750"},{"key":"684_CR56","unstructured":"Yang, A., Li, A., Yang, B., Zhang, B., Hui, B., Zheng, B., Yu, B., Gao, C., Huang, C., Lv, C., Zheng, C., Liu, D., Zhou, F., Huang, F., Hu, F., Ge, H., Wei, H., Lin, H., Tang, J., Yang, J., Tu, J., Zhang, J., Yang, J., Yang, J., Zhou, J., Zhou, J., Lin, J., Dang, K., Bao, K., Yang, K., Yu, L., Deng, L., Li, M., Xue, M., Li, M., Zhang, P., Wang, P., Zhu, Q., Men, R., Gao, R., Liu, S., Luo, S., Li, T., Tang, T., Yin, W., Ren, X., Wang, X., Zhang, X., Ren, X., Fan, Y., Su, Y., Zhang, Y., Zhang, Y., Wan, Y., Liu, Y., Wang, Z., Cui, Z., Zhang, Z., Zhou, Z., Qiu, Z.: Qwen3 Technical Report (2025). arxiv.org\/abs\/2505.09388"},{"key":"684_CR57","doi-asserted-by":"crossref","unstructured":"Ye, Z., Le, T.H.M., Babar, M.A.: LLMSecConfig: An LLM-Based Approach for Fixing Software Container Misconfigurations (2025). arxiv.org\/abs\/2502.02009","DOI":"10.1109\/MSR66628.2025.00099"},{"key":"684_CR58","doi-asserted-by":"publisher","unstructured":"Zeini, A., Lennon, R.G., Lennon, P.: Securing infrastructure as code (iac) through devsecops:a comprehensive risk management framework. In: 2023 Cyber Research Conference - Ireland (Cyber-RCI), pp. 1\u201311 (2023). https:\/\/doi.org\/10.1109\/Cyber-RCI59474.2023.10671452","DOI":"10.1109\/Cyber-RCI59474.2023.10671452"}],"container-title":["Automated Software Engineering"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10515-026-00684-z.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10515-026-00684-z","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10515-026-00684-z.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,21]],"date-time":"2026-09-21T23:16:33Z","timestamp":1790032593000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10515-026-00684-z"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,9,22]]},"references-count":58,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2026,12]]}},"alternative-id":["684"],"URL":"https:\/\/doi.org\/10.1007\/s10515-026-00684-z","relation":{},"ISSN":["0928-8910","1573-7535"],"issn-type":[{"value":"0928-8910","type":"print"},{"value":"1573-7535","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,9,22]]},"assertion":[{"value":"9 December 2025","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"9 September 2026","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"22 September 2026","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}],"article-number":"135"}}