Assessing and Improving Prompting Large Language Models for Software Vulnerability Analysis

TL;DR

This paper systematically evaluates LLMs for software vulnerability analysis and proposes a new prompting technique (VSP) leveraging vulnerability semantics to improve performance.

Problem

There is a lack of systematic assessment of how effective LLMs are for software vulnerability analysis (detection, classification, repair) and how prompt engineering can improve their performance.

Approach

A large-scale empirical study was conducted comparing ten LLMs with seven prompting strategies against nine traditional techniques on five real-world datasets (8,000+ C/C++ samples) across three vulnerability analysis tasks. The study identified incorrect reasoning issues in LLMs and developed Vulnerability-Semantics-guided Prompting (VSP), a chain-of-thought adaptation.

Results & Contribution

Existing prompting strategies often resulted in LLMs underperforming traditional approaches. The proposed VSP improved performance for some LLMs across the three tasks and mitigated reasoning limitations. The study also identified seven common challenges causing incorrect LLM answers and provided actionable recommendations for mitigation.