LATIDIA · Ciberseguridad

Exploración de la identificación automatizada de vulnerabilidades en el código JavaScript utilizando modelos de lenguaje grandes

arXiv: 2609.13816v1Tipo de anuncio: nuevo Resumen: JavaScript alimenta aproximadamente el 98.8% de todos los sitios web, lo que hace que las vulnerabilidades en su código sean un riesgo de seguridad significativo, pero los enfoques de detección existentes como Static Appl

La noticia

arXiv:2609.13816v1 Announce Type: new Abstract: JavaScript powers approximately 98.8% of all websites, making vulnerabilities in its code a significant security risk, yet existing detection approaches such as Static Application Security Testing (SAST) tools often fail to identify many real-world vulnerabilities when applied to isolated code snippets. This paper presents an empirical study of Large Language Model (LLM)-based vulnerability identification for JavaScript programs, evaluating three LLM families (Gemini 1.5 Flash, GPT-4o Mini, DeepSeek-R1-Distill-Llama-8B) across multiple prompting strategies (zero-shot, chain-of-thought, few-shot) and fine-tuning approaches on a dataset of 1,125 JavaScript code snippets spanning five Common Weakness Enumeration (CWE) categories: Injection (CWE-74), OS Command Injection (CWE-78), Cross-Site Scripting (CWE-79), SQL Injection (CWE-89), and