{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T17:38:12Z","timestamp":1790876292955,"version":"4.1.0"},"reference-count":73,"publisher":"Association for Computing Machinery (ACM)","issue":"8","funder":[{"DOI":"10.13039\/501100012166","name":"National Key R&D Program of China","doi-asserted-by":"crossref","award":["Grant No 2024YFB4506200"],"award-info":[{"award-number":["Grant No 2024YFB4506200"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Softw. Eng. Methodol."],"published-print":{"date-parts":[[2026,8,31]]},"abstract":"<jats:p>Accurate vulnerability detection is essential to prevent potential security breaches and protect software systems from malicious attacks. Recently, vulnerability detection approaches leveraging deep learning and large language models (LLMs) have garnered increasing attention. However, existing approaches often focus on analyzing individual files or functions, limiting their ability to detect complex and inter-procedural vulnerabilities. Analyzing entire repositories to gather context introduces significant noise and computational overhead. To address these challenges, we propose a context-enhanced approach for vulnerability detection by combining program analysis with LLMs. This method extracts contextual information at multiple abstraction levels to filter out noise, and feeds both the abstracted context and source code into an LLM. Our goal is to strike a balance between providing sufficient detail to accurately capture vulnerabilities and minimizing unnecessary complexity that could hinder model performance. Based on an extensive study using GPT, DeepSeek, and CodeLLaMA with various prompting strategies, our key findings include: First, incorporating abstracted context significantly enhances vulnerability detection effectiveness; Second, different models benefit from distinct levels of abstraction depending on their code understanding capabilities; Third, capturing program behavior through program analysis for general LLM-based code analysis tasks can be a direction that requires further attention.<\/jats:p>","DOI":"10.1145\/3779222","type":"journal-article","created":{"date-parts":[[2025,12,9]],"date-time":"2025-12-09T16:17:27Z","timestamp":1765297047000},"page":"1-47","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":8,"title":["Context-Enhanced Vulnerability Detection Based on Large Language Models"],"prefix":"10.1145","volume":"35","author":[{"ORCID":"https:\/\/orcid.org\/0009-0004-2492-8046","authenticated-orcid":false,"given":"Yixin","family":"Yang","sequence":"first","affiliation":[{"name":"Beihang University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0005-6661-7219","authenticated-orcid":false,"given":"Bowen","family":"Xu","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Complex &amp; Critical Software Environment (CCSE), Beihang University, Beijing, China and Hangzhou Innovation Institute of Beihang University, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9895-4600","authenticated-orcid":false,"given":"Xiang","family":"Gao","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Complex &amp; Critical Software Environment (CCSE), Beihang University, Beijing, China and Hangzhou Innovation Institute of Beihang University, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7654-5574","authenticated-orcid":false,"given":"Hailong","family":"Sun","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Complex &amp; Critical Software Environment (CCSE), Beihang University, Beijing, China and Hangzhou Innovation Institute of Beihang University, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,7,16]]},"reference":[{"key":"e_1_3_1_2_2","unstructured":"Josh Achiam Steven Adler Sandhini Agarwal Lama Ahmad Ilge Akkaya Florencia Leoni Aleman Diogo Almeida Janko Altenschmidt Sam Altman Shyamal Anadkat et al. 2023. GPT-4 technical report. arXiv2303.08774. Retrieved from https:\/\/arxiv.org\/abs\/2303.08774"},{"key":"e_1_3_1_3_2","doi-asserted-by":"publisher","DOI":"10.1145\/3290353"},{"key":"e_1_3_1_4_2","doi-asserted-by":"publisher","DOI":"10.1145\/3475960.3475985"},{"key":"e_1_3_1_5_2","unstructured":"Tom B. Brown. 2020. Language models are few-shot learners. arXiv:2005.14165. Retrieved from https:\/\/arxiv.org\/abs\/2005.14165"},{"key":"e_1_3_1_6_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2021.3087402"},{"key":"e_1_3_1_7_2","doi-asserted-by":"publisher","DOI":"10.5555\/1316689.1316758"},{"key":"e_1_3_1_8_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11432-023-4127-5"},{"key":"e_1_3_1_9_2","doi-asserted-by":"publisher","DOI":"10.1145\/3607199.3607242"},{"key":"e_1_3_1_10_2","doi-asserted-by":"publisher","DOI":"10.1145\/3650212.3652127"},{"key":"e_1_3_1_11_2","doi-asserted-by":"publisher","DOI":"10.1145\/3460319.3464807"},{"key":"e_1_3_1_12_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICECCS.2019.00012"},{"key":"e_1_3_1_13_2","unstructured":"DeepSeek-AI. 2024. DeepSeek-V3 technical report. arXiv:2412.19437. Retrieved from https:\/\/arxiv.org\/abs\/2412.19437"},{"key":"e_1_3_1_14_2","unstructured":"DeepSeek-AI. 2025. DeepSeek-R1: Incentivizing reasoning capability in LLMs via reinforcement learning. arXiv:2501.12948. Retrieved from https:\/\/arxiv.org\/abs\/2501.12948"},{"key":"e_1_3_1_15_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSME64153.2025.00019"},{"key":"e_1_3_1_16_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE55347.2025.00038"},{"key":"e_1_3_1_17_2","doi-asserted-by":"publisher","DOI":"10.1109\/SANER53432.2022.00114"},{"key":"e_1_3_1_18_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2019.00024"},{"key":"e_1_3_1_19_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.findings-acl.625"},{"key":"e_1_3_1_20_2","unstructured":"Xueying Du Geng Zheng Kaixin Wang Jiayi Feng Wentai Deng Mingwei Liu Bihuan Chen Xin Peng Tao Ma and Yiling Lou. 2024. Vul-RAG: Enhancing LLM-based vulnerability detection via knowledge-level RAG. arXiv:2406.11147. Retrieved from https:\/\/arxiv.org\/abs\/2406.11147"},{"key":"e_1_3_1_21_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-41579-2_2"},{"key":"e_1_3_1_22_2","doi-asserted-by":"publisher","DOI":"10.1145\/3379597.3387501"},{"key":"e_1_3_1_23_2","doi-asserted-by":"publisher","DOI":"10.1145\/3524842.3528452"},{"key":"e_1_3_1_24_2","doi-asserted-by":"publisher","DOI":"10.1109\/SMARTCOMP.2018.00096"},{"key":"e_1_3_1_25_2","doi-asserted-by":"publisher","DOI":"10.1049\/iet-ifs.2018.5615"},{"key":"e_1_3_1_26_2","unstructured":"Zeyu Han Chao Gao Jinyang Liu Jeff Zhang and Sai Qian Zhang. 2024. Parameter-efficient fine-tuning for large models: A comprehensive survey. arXiv:2403.14608. Retrieved from https:\/\/arxiv.org\/abs\/2403.14608"},{"key":"e_1_3_1_27_2","doi-asserted-by":"publisher","DOI":"10.1145\/3524842.3527949"},{"key":"e_1_3_1_28_2","doi-asserted-by":"publisher","DOI":"10.1145\/3671016.3671388"},{"key":"e_1_3_1_29_2","doi-asserted-by":"publisher","DOI":"10.1109\/HCCS59561.2023.10452613"},{"key":"e_1_3_1_30_2","doi-asserted-by":"publisher","DOI":"10.1109\/DSN48987.2021.00031"},{"key":"e_1_3_1_31_2","doi-asserted-by":"publisher","DOI":"10.1145\/3468264.3468597"},{"key":"e_1_3_1_32_2","volume-title":"Proceedings of the 13th International Conference on Learning Representations","author":"Li Ziyang","year":"2025","unstructured":"Ziyang Li, Saikat Dutta, and Mayur Naik. 2025. IRIS: LLM-Assisted static analysis for detecting security vulnerabilities. In Proceedings of the 13th International Conference on Learning Representations. Retrieved from https:\/\/openreview.net\/pdf?id=9LdJDU7E91"},{"key":"e_1_3_1_33_2","doi-asserted-by":"publisher","DOI":"10.1145\/3597503.3639218"},{"key":"e_1_3_1_34_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2930578"},{"key":"e_1_3_1_35_2","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2021.3051525"},{"key":"e_1_3_1_36_2","unstructured":"Qiheng Mao Zhenhao Li Xing Hu Kui Liu Xin Xia and Jianling Sun. 2024. Towards effectively detecting and explaining vulnerabilities using large language models. arXiv:2406.09701. Retrieved from https:\/\/arxiv.org\/abs\/2406.09701"},{"key":"e_1_3_1_37_2","unstructured":"National Vulnerability Database. 2021. National Vulnerability Database. Retrieved from https:\/\/nvd.nist.gov\/"},{"key":"e_1_3_1_38_2","doi-asserted-by":"publisher","DOI":"10.1145\/3510454.3516865"},{"key":"e_1_3_1_39_2","doi-asserted-by":"publisher","DOI":"10.1145\/3468264.3473122"},{"key":"e_1_3_1_40_2","unstructured":"OpenAI. 2024. GPT-4o system card. arXiv:2410.21276. Retrieved from https:\/\/arxiv.org\/abs\/2410.21276"},{"key":"e_1_3_1_41_2","doi-asserted-by":"publisher","DOI":"10.1109\/ISSREW60843.2023.00058"},{"key":"e_1_3_1_42_2","doi-asserted-by":"publisher","DOI":"10.1109\/CITSM.2017.8089237"},{"key":"e_1_3_1_43_2","doi-asserted-by":"publisher","DOI":"10.1561\/1500000019"},{"key":"e_1_3_1_44_2","unstructured":"Baptiste Rozi\u00e8re Jonas Gehring Fabian Gloeckle Sten Sootla Itai Gat Xiaoqing Ellen Tan Yossi Adi Jingyu Liu Romain Sauvestre Tal Remez et al. 2024. Code Llama: Open foundation models for code. arXiv:2308.12950. Retrieved from https:\/\/arxiv.org\/abs\/arXiv.2308.12950"},{"key":"e_1_3_1_45_2","doi-asserted-by":"publisher","DOI":"10.1038\/s41586-023-06647-8"},{"key":"e_1_3_1_46_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11416-010-0141-5"},{"key":"e_1_3_1_47_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2025.3546700"},{"key":"e_1_3_1_48_2","doi-asserted-by":"publisher","DOI":"10.1145\/3192366.3192418"},{"key":"e_1_3_1_49_2","doi-asserted-by":"publisher","DOI":"10.1145\/3643737"},{"key":"e_1_3_1_50_2","doi-asserted-by":"publisher","DOI":"10.1145\/3597503.3623345"},{"key":"e_1_3_1_51_2","unstructured":"Benjamin Steenhoek Md Mahbubur Rahman Monoshi Kumar Roy Mirza Sanjida Alam Earl T. Barr and Wei Le. 2024. A comprehensive study of the capabilities of large language models for vulnerability detection. arXiv.2403.17218. Retrieved from https:\/\/arxiv.org\/abs\/2403.17218"},{"key":"e_1_3_1_52_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCC59590.2023.10507456"},{"key":"e_1_3_1_53_2","unstructured":"Simeng Sun Yang Liu Dan Iter Chenguang Zhu and Mohit Iyyer. 2023. How does in-context learning help prompt tuning? arXiv:230211521. Retrieved from https:\/\/arxiv.org\/abs\/2302.11521"},{"key":"e_1_3_1_54_2","unstructured":"The Joern Team. 2024. Joern. Retrieved from https:\/\/joern.io"},{"key":"e_1_3_1_55_2","unstructured":"The MITRE Corporation. 2021. Common Vulnerabilities and Exposures (CVE). Retrieved from https:\/\/cve.mitre.org\/"},{"key":"e_1_3_1_56_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSME64153.2025.00020"},{"key":"e_1_3_1_57_2","unstructured":"Hugo Touvron Thibaut Lavril Gautier Izacard Xavier Martinet Marie-Anne Lachaux Timoth\u00e9e Lacroix Baptiste Rozi\u00e8re Naman Goyal Eric Hambro Faisal Azhar et al. 2023. Llama: Open and efficient foundation language models. arXiv:2302.13971. Retrieved from https:\/\/arxiv.org\/abs\/2302.13971"},{"key":"e_1_3_1_58_2","doi-asserted-by":"publisher","DOI":"10.1145\/3771923"},{"key":"e_1_3_1_59_2","doi-asserted-by":"publisher","DOI":"10.5555\/3600270.3602070"},{"key":"e_1_3_1_60_2","unstructured":"Xin-Cheng Wen Xinchen Wang Yujia Chen Ruida Hu David Lo and Cuiyun Gao. 2024. 2024. VulEval: Towards repository-level evaluation of software vulnerability detection. arXiv:2404.15596. Retrieved from https:\/\/arxiv.org\/abs\/2404.15596"},{"key":"e_1_3_1_61_2","doi-asserted-by":"publisher","DOI":"10.1155\/2022\/1176898"},{"key":"e_1_3_1_62_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2014.44"},{"key":"e_1_3_1_63_2","doi-asserted-by":"publisher","DOI":"10.1109\/SANER60148.2024.00075"},{"key":"e_1_3_1_64_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2024.112234"},{"key":"e_1_3_1_65_2","doi-asserted-by":"publisher","DOI":"10.1145\/3639478.3643065"},{"key":"e_1_3_1_66_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.findings-emnlp.649"},{"key":"e_1_3_1_67_2","doi-asserted-by":"publisher","DOI":"10.3390\/s24051351"},{"key":"e_1_3_1_68_2","doi-asserted-by":"publisher","DOI":"10.1145\/3609437.3609464"},{"key":"e_1_3_1_69_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11859-019-1380-z"},{"key":"e_1_3_1_70_2","unstructured":"Xin Zhou Duc-Manh Tran Thanh Le-Cong Ting Zhang Ivana Clairine Irsan Joshua Sumarlin Bach Le and David Lo. 2024. Comparison of static application security testing tools and large language models for repo-level vulnerability detection. arXiv2407.16235. Retrieved from https:\/\/arxiv.org\/abs\/2407.16235"},{"key":"e_1_3_1_71_2","doi-asserted-by":"publisher","DOI":"10.1145\/3639476.3639762"},{"key":"e_1_3_1_72_2","doi-asserted-by":"publisher","DOI":"10.5555\/3454287.3455202"},{"key":"e_1_3_1_73_2","doi-asserted-by":"publisher","DOI":"10.5555\/1260984.1261267"},{"key":"e_1_3_1_74_2","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2019.2942930"}],"container-title":["ACM Transactions on Software Engineering and Methodology"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3779222","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,16]],"date-time":"2026-07-16T15:34:00Z","timestamp":1784216040000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3779222"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,7,16]]},"references-count":73,"journal-issue":{"issue":"8","published-print":{"date-parts":[[2026,8,31]]}},"alternative-id":["10.1145\/3779222"],"URL":"https:\/\/doi.org\/10.1145\/3779222","relation":{},"ISSN":["1049-331X","1557-7392"],"issn-type":[{"value":"1049-331X","type":"print"},{"value":"1557-7392","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,7,16]]},"assertion":[{"value":"2025-04-17","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-11-12","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2026-07-16","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}