AI
New AI Method Dramatically Improves Detection of Hidden Vulnerabilities in Source Code
A novel technique that combines semantic analysis with language models achieves significantly better results at spotting security flaws in Java and C/C++ code.
Security researchers have developed a new approach to identifying hidden vulnerabilities in source code that substantially outperforms existing methods. The technique, which marries traditional program analysis with large language models, addresses a persistent problem in software security: current tools either produce unreliable results or fail to capture the full context needed to spot real flaws.
The Problem with Current Approaches#
Traditional static analysis tools struggle because they construct inaccurate representations of how programs actually work. Meanwhile, language model-based systems often overlook critical information about how code components relate to and affect each other. Neither approach alone provides the grounded reasoning needed for dependable vulnerability detection.
How VulWeaver Works#
The new system, called VulWeaver, takes a multi-layered approach. It begins by building an enhanced dependency graph that blends deterministic rules with semantic reasoning powered by language models, correcting the typical blind spots of static analysis. The method then gathers comprehensive context around potential vulnerabilities by extracting both explicit information from code slicing and implicit details about how variables are used, defined, and declared throughout the program.
To ensure reliability, VulWeaver applies specialized reasoning prompts tailored to different vulnerability types, then combines predictions from multiple runs using majority voting. This strategy prevents the system from being led astray by any single inference.
Impressive Test Results#
In tests on a large Java vulnerability dataset, VulWeaver achieved 82% precision, 71% recall, and a 0.76 F1-score—metrics that measure how accurately it identifies genuine flaws while avoiding false positives. These results surpassed comparable learning-based, LLM-based, and agent-based systems by 25%, 17%, and 21% respectively. A specialized metric that evaluates the system's ability to distinguish vulnerable code from its fixed versions showed performance 164% better than the leading alternative approach.
The method also transfers well across languages: when applied to C/C++ code with minimal adjustments, it achieved a 0.78 F1-score, suggesting the underlying principles generalize beyond Java.
