# Detection of security smells in IaC scripts through semantics-aware code and language processing

arXiv: https://arxiv.org/abs/2509.18790 · HTML: https://mlsanity.com/paper/2509.18790/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 11 of its 35 references that are in the map.
- First posted on arXiv 23 Sep 2025.

## Builds on (most cited first, 11 of 11)

- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [Ignore Previous Prompt: Attack Techniques For Language Models](https://mlsanity.com/paper/2211.09527/) (2022)
- [Multitask-based Evaluation of Open-Source LLM on Software Vulnerability](https://mlsanity.com/paper/2404.02056/) (2024)
- [Everything You Wanted to Know About LLM-based Vulnerability Detection But Were Afraid to Ask](https://mlsanity.com/paper/2504.13474/) (2025)
- [GenKubeSec: LLM-Based Kubernetes Misconfiguration Detection, Localization, Reasoning, and Remediation](https://mlsanity.com/paper/2405.19954/) (2024)
- [Analyzing and Mitigating (with LLMs) the Security Misconfigurations of Helm Charts from Artifact Hub](https://mlsanity.com/paper/2403.09537/) (2024)
- [A Survey on Automated Software Vulnerability Detection Using Machine Learning and Deep Learning](https://mlsanity.com/paper/2306.11673/) (2023)
- [GLITCH: Automated Polyglot Security Smell Detection in Infrastructure as Code](https://mlsanity.com/paper/2205.14371/) (2022)
- [LLM-Based Misconfiguration Detection for AWS Serverless Computing](https://mlsanity.com/paper/2411.00642/) (2024)
- [DeepIaC: Deep Learning-Based Linguistic Anti-pattern Detection in IaC](https://mlsanity.com/paper/2009.10801/) (2020)
- [Static Analysis of Infrastructure as Code: a Survey](https://mlsanity.com/paper/2206.10344/) (2022)

## Abstract (arXiv)

Infrastructure as Code (IaC) automates the provisioning and management of IT infrastructure through scripts and tools, streamlining software deployment. Prior studies have shown that IaC scripts often contain recurring security misconfigurations, and several detection and mitigation approaches have been proposed. Most of these rely on static analysis, using statistical code representations or Machine Learning (ML) classifiers to distinguish insecure configurations from safe code. In this work, we introduce a novel approach that enhances static analysis with semantic understanding by jointly leveraging natural language and code representations. Our method builds on two complementary ML models: CodeBERT, to capture semantics across code and text, and LongFormer, to represent long IaC scripts without losing contextual information. We evaluate our approach on misconfiguration datasets from two widely used IaC tools, Ansible and Puppet. To validate its effectiveness, we conduct two ablation studies (removing code text from the natural language input and truncating scripts to reduce context) and compare against four large language models (LLMs) and prior work. Results show that semantic enrichment substantially improves detection, raising precision and recall from 0.46 and 0.79 to 0.92 and 0.88 on Ansible, and from 0.55 and 0.97 to 0.87 and 0.75 on Puppet, respectively.