LATIDIA · Ciberseguridad

Análisis estático autoevolutivo a través del pseudoetiquetado LLM

arXiv:2610.30184v1 Announce Type: new Resumen: Los errores de seguridad a menudo pasan por alto el análisis estático no porque sean imposibles de detectar, sino porque aún no se han escrito reglas de detección para el código que tenemos delante.

La noticia

arXiv:2610.30184v1 Announce Type: new Abstract: Security bugs often slip past static analysis not because they are impossible to detect, but because detection rules have not yet been written for the code in front of us. New frameworks, APIs, and coding idioms continually create such gaps, leaving developers to discover failures and manually encode new rules. We present SESAA, a framework in which an Large Language Model (LLM) agent starts from no rules and iteratively evolves a set of readable and auditable joern queries. The agent receives feedback only from a second LLM critic, which inspects flagged and unflagged code to identify likely false alarms and suspected misses, without access to