{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,17]],"date-time":"2026-07-17T06:04:51Z","timestamp":1784268291756,"version":"3.55.0"},"reference-count":44,"publisher":"IEEE","license":[{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,5,18]]},"DOI":"10.1109\/icstw72326.2026.00040","type":"proceedings-article","created":{"date-parts":[[2026,7,16]],"date-time":"2026-07-16T21:47:20Z","timestamp":1784238440000},"page":"163-172","source":"Crossref","is-referenced-by-count":0,"title":["Friends or Foes? Combining Static Analysis Tools and LLMs for Vulnerability Detection"],"prefix":"10.1109","author":[{"given":"Rafael","family":"Ramires","sequence":"first","affiliation":[{"name":"Universidade de Lisboa,LASIGE, DI, Faculdade de Ciências,Portugal"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sarmad","family":"Bashir","sequence":"additional","affiliation":[{"name":"RISE Research Institutes of Sweden,Västerås,Sweden"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Abbas","family":"Khan","sequence":"additional","affiliation":[{"name":"RISE Research Institutes of Sweden,Västerås,Sweden"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mehrdad","family":"Saadatmand","sequence":"additional","affiliation":[{"name":"RISE Research Institutes of Sweden,Västerås,Sweden"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ib\u00e9ria","family":"Medeiros","sequence":"additional","affiliation":[{"name":"Universidade de Lisboa,LASIGE, DI, Faculdade de Ciências,Portugal"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","article-title":"OWASP Top Ten 2025","year":"2025"},{"key":"ref2","article-title":"Critical mitel flaw lets hackers bypass login, gain full access to mivoice mx-one systems","year":"2025"},{"key":"ref3","article-title":"China-linked hackers exploit sap and sql server flaws in attacks across asia and brazil","year":"2025"},{"key":"ref4","article-title":"Fortinet releases patch for critical sql injection flaw in fortiweb","year":"2025"},{"key":"ref5","article-title":"CVE Details","year":"2026"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/TR.2015.2457411"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/NCA51143.2020.9306735"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/ICWS62655.2024.00070"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/3589334.3645530"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179420"},{"key":"ref11","article-title":"Can large language models find and fix vulnerable software?","author":"Noever","year":"2023"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-92882-6_12"},{"key":"ref13","article-title":"IRIS: LLM-assisted static analysis for detecting security vulnerabilities","volume-title":"Proceedings of the 13rd International Conference on Learning Representations","author":"Li"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1145\/3708522"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/3769082"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-29786-1_8"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/3708522"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.7753\/ijcatr1409.1002"},{"key":"ref19","doi-asserted-by":"crossref","DOI":"10.36227\/techrxiv.174060306.65738406\/v1","article-title":"Qwen 2.5: A comprehensive review of the leading resource-efficient llm with potential to surpass all competitors","author":"Ahmed","year":"2025"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2023.3329667"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/ISSRE59848.2023.00042"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.3390\/e27090926"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1007\/s00607-018-0664-z"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/3611643.3616262"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1145\/3661167.3661262"},{"key":"ref26","article-title":"Usage statistics of server-side programming languages for websites","year":"2025"},{"key":"ref27","article-title":"A classification of sql injection attacks and countermeasures","volume-title":"Proceedings of the International Symposium on Secure Software Engineering (ISSE)","author":"Halfond"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2004.1317494"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/TR.2021.3137314"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/EDCC-C66476.2025.00033"},{"key":"ref31","article-title":"NIST Software Assurance Reference Dataset (SARD)","year":"2025"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/EDCC51268.2020.00027"},{"key":"ref33","doi-asserted-by":"crossref","DOI":"10.1109\/ICWS62655.2024.00070","article-title":"KAVe: Knowledge-Based Multi-Agent System Vulnerability Detector","author":"Ramires","year":"2024"},{"key":"ref34","article-title":"SonarQube","year":"2026"},{"key":"ref35","article-title":"Gpt-4o","year":"2025"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1038\/s42256-023-00626-4"},{"issue":"2","key":"ref37","first-page":"3","article-title":"Lora: Low-rank adaptation of large language models","volume":"1","author":"Hu","year":"2022","journal-title":"ICLR"},{"key":"ref38","article-title":"Qwen 2.5-Coder","year":"2024"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1145\/3485447.3512235"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/QRS-C63300.2024.00122"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1007\/s11704-026-60308-3"},{"key":"ref42","article-title":"Evaluating large language models trained on code","author":"Chen","year":"2021"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.acl-main.740"},{"key":"ref44","article-title":"Transformer-based vulnerability detection in code at edittime: Zero-shot, few-shot, or fine-tuning?","author":"Chan","year":"2023"}],"event":{"name":"2026 IEEE International Conference on Software Testing, Verification and Validation Workshops (ICSTW)","location":"Daejeon, Korea, Republic of","start":{"date-parts":[[2026,5,18]]},"end":{"date-parts":[[2026,5,22]]}},"container-title":["2026 IEEE International Conference on Software Testing, Verification and Validation Workshops (ICSTW)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11600400\/11600402\/11600417.pdf?arnumber=11600417","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,17]],"date-time":"2026-07-17T05:22:01Z","timestamp":1784265721000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11600417\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,18]]},"references-count":44,"URL":"https:\/\/doi.org\/10.1109\/icstw72326.2026.00040","relation":{},"subject":[],"published":{"date-parts":[[2026,5,18]]}}}