mlsanityData to 7 Oct 2026

IRIS: LLM-Assisted Static Analysis for Detecting Security Vulnerabilities

arXiv 2405.17238 ↗First posted 27 May 2024cs.CR cs.PL cs.SEcited by 100

Not on the map. Why?

Cited by 43 in LLM agents and tool use, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Software is prone to security vulnerabilities. Program analysis tools to detect them have limited effectiveness in practice due to their reliance on human labeled specifications. Large language models (or LLMs) have shown impressive code generation capabilities but they cannot do complex reasoning over code to detect such vulnerabilities especially since this task requires whole-repository analysis. We propose IRIS, a neuro-symbolic approach that systematically combines LLMs with static analysis to perform whole-repository reasoning for security vulnerability detection. Specifically, IRIS leverages LLMs to infer taint specifications and perform contextual analysis, alleviating needs for human specifications and inspection. For evaluation, we curate a new dataset, CWE-Bench-Java, comprising 120 manually validated security vulnerabilities in real-world Java projects. A state-of-the-art static analysis tool CodeQL detects only 27 of these vulnerabilities whereas IRIS with GPT-4 detects 55 (+28) and improves upon CodeQL's average false discovery rate by 5% points. Furthermore, IRIS identifies 4 previously unknown vulnerabilities which cannot be found by existing tools. IRIS is available publicly at https://github.com/iris-sast/iris.

Key facts. Cited by 100 papers in the map (data through 7 Oct 2026). First posted on arXiv 27 May 2024.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 11; 2025: 47; 2026: 42.

100 papers.

Sort:

By area:

  1. 2024Large Language Model-Based Agents for Software Engineering: A Surveycited by 173
  2. 2024Vul-RAG: Enhancing LLM-based Vulnerability Detection via Knowledge-level RAGcited by 67
  3. 2025RepoAudit: An Autonomous LLM-Agent for Repository-Level Code Auditingcited by 47
  4. 2025LLMs in Software Security: A Survey of Vulnerability Detection Techniques and Insightscited by 44
  5. 2024Human-In-the-Loop Software Development Agentscited by 42
  6. 2025Repo2Run: Automated Building Executable Environment for Code Repository at Scalecited by 39
  7. 2025BaxBench: Can LLMs Generate Correct and Secure Backends?cited by 38
  8. 2025AI Agentic Programming: A Survey of Techniques, Challenges, and Opportunitiescited by 26
  9. 2025KNighter: Transforming Static Analysis with LLM-Synthesized Checkerscited by 22
  10. 2025Frontier AI's Impact on the Cybersecurity Landscapecited by 21
  11. 2025A Survey on Agentic Security: Applications, Threats and Defensescited by 17
  12. 2025Understanding Automated Program Repair Agents Through the Lens of Traceability: An Empirical Studycited by 16
38 more
  1. 2025Large Language Model (LLM) for Software Security: Code Analysis, Malware Analysis, Reverse Engineeringcited by 15
  2. 2024SECURE: Benchmarking Large Language Models for Cybersecuritycited by 13
  3. 2025FaultLine: Automated Proof-of-Vulnerability Generation Using LLM Agentscited by 11
  4. 2025VulnLLM-R: Specialized Reasoning LLM with Agent Scaffold for Vulnerability Detectioncited by 11
  5. 2025A Contemporary Survey of Large Language Model Assisted Program Analysiscited by 10
  6. 2025CASTLE: Benchmarking Dataset for Static Code Analyzers and LLMs towards CWE Detectioncited by 10
  7. 2025Rethinking the Evaluation of Secure Code Generationcited by 10
  8. 2024From Vulnerabilities to Remediation: A Systematic Literature Review of LLMs in Code Securitycited by 9
  9. 2024LProtector: An LLM-driven Vulnerability Detection Systemcited by 8
  10. 2025OSVBench: Benchmarking LLMs on Specification Generation Tasks for Operating System Verificationcited by 8
  11. 2025Locus: Agentic Predicate Synthesis for Directed Fuzzingcited by 8
  12. 2024Enhancing Automated Loop Invariant Generation for Complex Programs with Large Language Modelscited by 7
  13. 2025Reasoning with LLMs for Zero-Shot Vulnerability Detectioncited by 7
  14. 2025RFCAudit: An LLM Agent for Functional Bug Detection in Network Protocolscited by 7
  15. 2025A Comprehensive Empirical Evaluation of Agent Frameworks on Code-centric Software Engineering Taskscited by 7
  16. 2024Harnessing the Power of LLMs in Source Code Vulnerability Detectioncited by 6
  17. 2024Helping LLMs Improve Code Generation Using Feedback from Testing and Static Analysiscited by 6
  18. 2025CodeVisionary: An Agent-based Framework for Evaluating Large Language Models in Code Generationcited by 6
  19. 2025QLPro: Automated Code Vulnerability Discovery via LLM and Static Code Analysis Integrationcited by 6
  20. 2025One Bug, Hundreds Behind: LLMs for Large-Scale Bug Discoverycited by 6
  21. 2026When Agents Do Not Stop: Uncovering Infinite Agentic Loops in LLM Agentscited by 6
  22. 2025PredicateFix: Repairing Static Analysis Alerts with Bridging Predicatescited by 5
  23. 2025Large Language Models for Validating Network Protocol Parserscited by 5
  24. 2025Trace Gadgets: Minimizing Code Context for Machine Learning-Based Vulnerability Predictioncited by 5
  25. 2025How Safe Are AI-Generated Patches? A Large-scale Study on Security Risks in LLM and Agentic Automated Program Repair on SWE-benchcited by 5
  26. 2026Reducing False Positives in Static Bug Detection with LLMs: An Empirical Study in Industrycited by 5
  27. 2026Sifting the Noise: A Comparative Study of LLM Agents in Vulnerability False Positive Filteringcited by 5
  28. 2025XOXO: Stealthy Cross-Origin Context Poisoning Attacks against AI Coding Assistantscited by 4
  29. 2025Lobster: A GPU-Accelerated Framework for Neurosymbolic Programmingcited by 4
  30. 2025The Hitchhiker's Guide to Program Analysis, Part II: Deep Thoughts by LLMscited by 4
  31. 2025Benchmarking LLM-Assisted Blue Teaming via Standardized Threat Huntingcited by 4
  32. 2025LLM Agents for Automated Web Vulnerability Reproduction: Are We There Yet?cited by 4
  33. 2025ESCA: Contextualizing Embodied Agents via Scene-Graph Generationcited by 4
  34. 2025AthenaBench: A Dynamic Benchmark for Evaluating LLMs in Cyber Threat Intelligencecited by 4
  35. 2025VulInstruct: Teaching LLMs Root-Cause Reasoning for Vulnerability Detection via Security Specificationscited by 4
  36. 2025AutoBaxBuilder: Bootstrapping Code Security Benchmarkingcited by 4
  37. 2026OpenSage: Self-programming Agent Generation Enginecited by 4
  38. 2026AnyPoC: Universal Proof-of-Concept Test Generation for Scalable LLM-Based Bug Detectioncited by 4

50 most cited of 100 All 100 (JSON)