AutoVulnFix: LLM-driven intelligent search and adaptive vulnerability repair system

Ding Yixin; Zhao Xinjian; Wu Zicheng; Han Hao

doi:10.11959/j.issn.2096-109x.2026009

您当前的位置：

首页 >

文章列表页 >

AutoVulnFix: LLM-driven intelligent search and adaptive vulnerability repair system

Papers | 更新时间：2026-05-26

- AutoVulnFix: LLM-driven intelligent search and adaptive vulnerability repair system
- Chinese Journal of Network and Information Security Vol. 12, Issue 1, Pages: 128-140(2026)
- 作者机构：
  
  1.国网江苏省电力有限公司，江苏南京 210024
  2.南京航空航天大学，江苏南京 211106
- 作者简介：
- 基金信息：
  
  The Science and Technology Project of State Grid Jiangsu Electric Power Co., Ltd(J2024169)
- DOI：10.11959/j.issn.2096-109x.2026009
  CLC： TP393
- Received：22 September 2025，
  
  Revised：2025-12-13，
  
  Published：25 February 2026
- 稿件说明：
移动端阅览
丁一新, 赵新建, 吴子成, 等. AutoVulnFix:大语言模型驱动的智能搜索自适应漏洞修复系统[J]. 网络与信息安全学报, 2026, 12(1): 128-140.

Ding Yixin, Zhao Xinjian, Wu Zicheng, et al. AutoVulnFix: LLM-driven intelligent search and adaptive vulnerability repair system[J]. Chinese Journal of Network and Information Security, 2026, 12(1): 128-140.
丁一新, 赵新建, 吴子成, 等. AutoVulnFix:大语言模型驱动的智能搜索自适应漏洞修复系统[J]. 网络与信息安全学报, 2026, 12(1): 128-140. DOI： 10.11959/j.issn.2096-109x.2026009.

Ding Yixin, Zhao Xinjian, Wu Zicheng, et al. AutoVulnFix: LLM-driven intelligent search and adaptive vulnerability repair system[J]. Chinese Journal of Network and Information Security, 2026, 12(1): 128-140. DOI： 10.11959/j.issn.2096-109x.2026009.

摘要

自动程序修复（automatic program repair

APR）技术在软件工程领域占据重要地位，但现有基于大语言模型的APR方法在搜索定位、执行效率和成本控制方面存在明显不足。为此，提出一种基于轻量智能搜索的自适应程序修复系统AutoVulnFix。该系统通过精简Prompt策略、双轨智能搜索算法和双层缓存三大核心技术解决现有问题。具体而言，首先通过智能上下文管理和精准问题描述降低Token开销，然后通过延迟加载和智能缓存策略提升系统的响应速度，最后结合快速搜索轨道和智能搜索轨道，根据任务复杂度自适应选择最优搜索策略。在包含231个代码缺陷样本的数据集上对5种大语言模型进行了全面的对比评估，结果表明，AutoVulnFix在修复准确率方面平均提升4.2%，在执行时间方面平均缩短25.8%，在Token开销方面平均降低21.4%。该系统为APR技术的实用化部署提供了有效的解决方案。

Abstract

Automatic program repair (APR) technology holds a significant position in the field of software engineering

but existing large language model based APR methods suffer from significant limitations in search localization

execution efficiency

and cost control. To address these issues

an adaptive program repair system named AutoVulnFix based on lightweight intelligent search was proposed. This system resolved the existing problems through three core technologies: a simplified prompt strategy

a dual-track intelligent search algorithm

and multi-level cache. Specifically

it first reduced token costs by intelligent context management and precise problem description

then enhanced the system's response speed through delayed loading and intelligent caching strategies

and finally combined a fast search track and an intelligent search track to adaptively select the optimal search strategy based on task complexity. A comprehensive comparative evaluation was conducted on five large language models using a dataset containing 231 code defect samples. Experimental results demonstrate that AutoVulnFix achieves an average improvement of 4.2 percentage points in repair accuracy

an average reduction of 25.8% in execution time

and an average saving of 21.4% in token consumption. The system provides an effective solution for practical deployment of APR technology.

关键词

Keywords

references

Le Goues C , Nguyen T , Forrest S , et al . GenProg: a generic method for automatic software repair [J ] . IEEE Transactions on Software Engineering , 2012 , 38 ( 1 ): 54 - 72 .

Le Goues C , Holtschulte N , Smith E K , et al . The ManyBugs and IntroClass benchmarks for automated repair of C programs [J ] . IEEE Transactions on Software Engineering , 2015 , 41 ( 12 ): 1236 - 1256 .

Yuan Y , Banzhaf W . ARJA: automated repair of Java programs via multi-objective genetic programming [J ] . IEEE Transactions on Software Engineering , 2020 , 46 ( 10 ): 1040 - 1067 .

Wang Y , Wang W S , Joty S , et al . CodeT5: identifier-aware unified pre-trained encoder-decoder models for code understanding and generation [C ] // Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing . Stroudsburg, PA, USA : ACL , 2021 : 8696 - 8708 .

Fried D , Aghajanyan A , Lin J , et al . InCoder: a generative model for code infilling and synthesis [PP ] . arXivpreprint , 2022 , arXiv: 2204.05999 .

Feng Z Y , Guo D Y , Tang D Y , et al . CodeBERT: a pre-trained model for programming and natural languages [C ] // Proceedings of the Findings of the Association for Computational Linguistics: EMNLP 2020 . Stroudsburg : ACL , 2020 : 1536 - 1547 .

Chen Z M , Kommrusch S , Tufano M , et al . SequenceR: sequence-to-sequence learning for end-to-end program repair [J ] . IEEE Transactions on Software Engineering , 2021 , 47 ( 9 ): 1943 - 1959 .

Lutellier T , Pham H V , Pang L , et al . CoCoNuT: combining context-aware neural translation models using ensemble for program repair [C ] // Proceedings of the 29th ACM SIGSOFT International Symposium on Software Testing and Analysis . New York : ACM , 2020 : 101 - 114 .

White M , Tufano M , Vendome C , et al . Deep learning code fragments for code clone detection [C ] // Proceedings of the 31st IEEE/ACM International Conference on Automated Software Engineering . New York : ACM , 2016 : 87 - 98 .

Zhang Y T , Ruan H F , Fan Z Y , et al . AutoCodeRover: autonomous program improvement [C ] // Proceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis . New York : ACM , 2024 : 1592 - 1604 .

Monperrus M . Automatic software repair: a bibliography [J ] . ACM Computing Surveys , 2019 , 51 ( 1 ): 1 - 24 .

Rao S , Kak A . Retrieval from software libraries for bug localization: a comparative study of generic and composite text models [C ] // Proceedings of the 8th Working Conference on Mining Software Repositories . New York : ACM , 2011 : 43 - 52 .

Zhou J , Zhang H Y , Lo D . Where should the bugs be fixed? More accurate information retrieval-based bug localization based on bug reports [C ] // Proceedings of the 2012 34th International Conference on Software Engineering (ICSE) . Piscataway : IEEE Press , 2012 : 14 - 24 .

Kim D , Nam J , Song J , et al . Automatic patch generation learned from human-written patches [C ] // Proceedings of the 2013 35th International Conference on Software Engineering (ICSE) . Piscataway : IEEE Press , 2013 : 802 - 811 .

Nguyen H D T , Qi D W , Roychoudhury A , et al . SemFix: Program repair via semantic analysis [C ] // Proceedings of the 2013 35th International Conference on Software Engineering (ICSE) . Piscataway : IEEE Press , 2013 : 772 - 781 .

Mechtaev S , Yi J , Roychoudhury A . DirectFix: looking for simple program repairs [C ] // Proceedings of the 2015 IEEE/ACM 37th IEEE International Conference on Software Engineering . Piscataway : IEEE Press , 2015 : 448 - 458 .

Koyuncu A , Liu K , Bissyandé T F , et al . FixMiner: Mining relevant fix patterns for automated program repair [J ] . Empirical Software Engineering , 2020 , 25 ( 3 ): 1980 - 2024 .

Liu K , Koyuncu A , Kim D , et al . TBar: revisiting template-based automated program repair [C ] // Proceedings of the 28th ACM SIGSOFT International Symposium on Software Testing and Analysis . New York : ACM , 2019 : 31 - 42 .

Qi Z C , Long F , Achour S , et al . An analysis of patch plausibility and correctness for generate-and-validate patch generation systems [C ] // Proceedings of the 2015 International Symposium on Software Testing and Analysis . New York : ACM , 2015 : 24 - 36 .

Xia C S , Zhang L M . Automated program repair via conversation: fixing 162 out of 337 bugs for $0.42 each using ChatGPT [C ] // Proceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis . New York : ACM , 2024 : 819 - 831 .

Guo D Y , Lu S , Duan N , et al . UniXcoder: unified cross-modal pre-training for code representation [C ] // Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) . Stroudsburg, PA, USA : ACL , 2022 : 7212 - 7225 .

Yamaguchi F , Golde N , Arp D , et al . Modeling and discovering vulnerabilities with code property graphs [C ] // Proceedings of the 2014 IEEE Symposium on Security and Privacy . Piscataway : IEEE Press , 2014 : 590 - 604 .

Ferrante J , Ottenstein K J , Warren J D . The program dependence graph and its use in optimization [C ] // International Symposium on Programming . Berlin, Heidelberg : Springer , 1984 : 125 - 132 .

Liu T Y . Learning to rank for information retrieval [J ] . Foundations and Trends® in Information Retrieval , 2009 , 3 ( 3 ): 225 - 331 .

Jimenez C E , Yang J , Wettig A , et al . SWE-bench: can language models resolve real-world GitHub issues? [PP ] . arXivpreprint , 2023 , arXiv: 2310.06770 .

Just R , Jalali D , Ernst M D . Defects4 J: a database of existing faults to enable controlled testing studies for Java programs[C ] // Proceedings of the 2014 International Symposium on Software Testing and Analysis . New York : ACM , 2014 : 437 - 440 .

Lin D , Koppel J , Chen A , et al . QuixBugs: a multi-lingual program repair benchmark set based on the quixey challenge [C ] // Proceedings of the Proceedings Companion of the 2017 ACM SIGPLAN International Conference on Systems, Programming, Languages, and Applications: Software for Humanity . New York : ACM , 2017 : 55 - 56 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Bidirectional privacy authorization for large models based on private set intersection

mmDefender: enhancing large language model with multimodal multilingual adversarial training

Survey on automated vulnerability mining techniques for IoT device firmware

Detecting privacy compliance of mobile applications from the perspective of the "minimum necessary" principle

Instruction and demonstration-based secure service attribute generation mechanism for textual data

Related Author

WANG Yuanyuan

FENG Haokang

WU Xuguang

HAN Yiliang

YANG Shuai

DAI Yuwen

CHEN Kai

WU Tianqi

Related Institution

College of Cryptography Engineering, Engineering University of PAP

Key Laboratory of Counter-Terrorism Command Information Engineering of the Ministry of Education, Engineering University of PAP

State Grid Laboratory of Power Cyber-Security Protection and Monitoring Technology, China Electric Power Research Institute

Information Engineering University

Laboratory for Advanced Computing and Intelligence Engineering

⁰