Software vulnerability detection increasingly relies on learning-based models. However, most existing methods analyze individual functions in isolation, making it difficult to capture vulnerabilities caused by cross-function calls; directly introducing complete call chains can also lead to context expansion and noise accumulation. This paper proposes VulRESC, a vulnerability detection framework based on risk path extraction and interprocedural semantic completion. The method first constructs code property graphs and extracts call paths related to external inputs and high-risk operations through a riskpoint- driven pruning strategy. It then uses large language models to generate structured summaries for callees along the sequence in a bottom-up manner and introduces a variable-name alignment mechanism to bridge the semantic gap across function boundaries. Finally, the proposed DualVulBERT dual-stream model is employed to jointly identify vulnerabilities by fusing source code features and inter-procedural semantic summaries through cross-modal attention. Experimental results on real-world C/C++ vulnerability datasets show that VulRESC achieves an accuracy of 68.03% and an F1-score of 69.37%, outperforming representative existing methods.
Yukun Dong, Shuo Wang, Shanchen Pang· International journal of sof...· 0 citations
Large Language Model (LLM) agents are increasingly adopted in real-world security operations with access to host artifacts and command-line interfaces (CLIs), making it critical to thoroughly assess their security capabilities. However, existing cybersecurity benchmarks focus on pre-compromise settings where agents are placed in a clean and idealized environment before an attack occurs. This leaves the post-compromise setting underexplored. To address this gap, we introduce SecRespond, the first benchmark for evaluating LLM agents on the post-compromise incident-response workflow. Given a forensic disk snapshot of a compromised host together with the alerts, vulnerability scans, and baseline checks reported by a host security product, agents are required to produce forensic reports on intrusions, baseline risks, and vulnerability risks, together with a remediation plan. We instantiate this task across 10 cyber ranges, each constructed from a distinct compromised cloud host, spanning 4 entry-point types, 21 ATT&CK techniques, and 5 operating systems. We evaluate 23 frontier LLMs on the OpenCode agent harness. Experimental results show that although current agents can reliably uncover the problems exposed by alerts, they struggle to proactively investigate the disk for silent intrusions and to produce comprehensive, verified remediation plans, with no model achieving complete detection and remediation on any single range. This reveals a fundamental bottleneck in building agents for real-world incident response. The benchmark is publicly available at https://github.com/Alibaba-NLP/qqr/tree/main/data/secrespond.
Lehan Wang, Boli Chen, Ruixue Ding et al.· 0 citations