AutoVulnFix:大语言模型驱动的智能搜索自适应漏洞修复系统

丁一新; 赵新建; 吴子成; 韩皓

doi:10.11959/j.issn.2096-109x.2026009

您当前的位置：

首页 >

文章列表页 >

AutoVulnFix:大语言模型驱动的智能搜索自适应漏洞修复系统

学术论文 | 更新时间：2026-05-26

- AutoVulnFix:大语言模型驱动的智能搜索自适应漏洞修复系统
- AutoVulnFix: LLM-driven intelligent search and adaptive vulnerability repair system
- 网络与信息安全学报 2026年12卷第1期页码：128-140
- 作者机构：
  
  1.国网江苏省电力有限公司，江苏南京 210024
  2.南京航空航天大学，江苏南京 211106
- 作者简介：
  
  丁一新（1975- ），男，江苏溧阳人，国网江苏省电力有限公司高级工程师，主要研究方向为网络运维与网络安全。
  赵新建（1987- ），男，山东济宁人，国网江苏省电力有限公司高级工程师，主要研究方向为网络与信息安全。
  吴子成（1998- ），男，江苏南京人，国网江苏省电力有限公司助理工程师，主要研究方向为软件安全、Web 安全和安全攻防技术等。
  韩皓（1982- ），男，上海人，博士，南京航空航天大学教授，主要研究方向为系统与软件安全、AI安全等。
- 基金信息：
  
  国网江苏省电力有限公司科技项目(J2024169)
- DOI：10.11959/j.issn.2096-109x.2026009
  中图分类号： TP393
- 收稿：2025-09-22，
  
  修回：2025-12-13，
  
  纸质出版：2026-02-25
- 稿件说明：
移动端阅览
丁一新, 赵新建, 吴子成, 等. AutoVulnFix:大语言模型驱动的智能搜索自适应漏洞修复系统[J]. 网络与信息安全学报, 2026, 12(1): 128-140.

Ding Yixin, Zhao Xinjian, Wu Zicheng, et al. AutoVulnFix: LLM-driven intelligent search and adaptive vulnerability repair system[J]. Chinese Journal of Network and Information Security, 2026, 12(1): 128-140.
丁一新, 赵新建, 吴子成, 等. AutoVulnFix:大语言模型驱动的智能搜索自适应漏洞修复系统[J]. 网络与信息安全学报, 2026, 12(1): 128-140. DOI： 10.11959/j.issn.2096-109x.2026009.

Ding Yixin, Zhao Xinjian, Wu Zicheng, et al. AutoVulnFix: LLM-driven intelligent search and adaptive vulnerability repair system[J]. Chinese Journal of Network and Information Security, 2026, 12(1): 128-140. DOI： 10.11959/j.issn.2096-109x.2026009.

摘要

自动程序修复（automatic program repair

APR）技术在软件工程领域占据重要地位，但现有基于大语言模型的APR方法在搜索定位、执行效率和成本控制方面存在明显不足。为此，提出一种基于轻量智能搜索的自适应程序修复系统AutoVulnFix。该系统通过精简Prompt策略、双轨智能搜索算法和双层缓存三大核心技术解决现有问题。具体而言，首先通过智能上下文管理和精准问题描述降低Token开销，然后通过延迟加载和智能缓存策略提升系统的响应速度，最后结合快速搜索轨道和智能搜索轨道，根据任务复杂度自适应选择最优搜索策略。在包含231个代码缺陷样本的数据集上对5种大语言模型进行了全面的对比评估，结果表明，AutoVulnFix在修复准确率方面平均提升4.2%，在执行时间方面平均缩短25.8%，在Token开销方面平均降低21.4%。该系统为APR技术的实用化部署提供了有效的解决方案。

Abstract

Automatic program repair (APR) technology holds a significant position in the field of software engineering

but existing large language model based APR methods suffer from significant limitations in search localization

execution efficiency

and cost control. To address these issues

an adaptive program repair system named AutoVulnFix based on lightweight intelligent search was proposed. This system resolved the existing problems through three core technologies: a simplified prompt strategy

a dual-track intelligent search algorithm

and multi-level cache. Specifically

it first reduced token costs by intelligent context management and precise problem description

then enhanced the system's response speed through delayed loading and intelligent caching strategies

and finally combined a fast search track and an intelligent search track to adaptively select the optimal search strategy based on task complexity. A comprehensive comparative evaluation was conducted on five large language models using a dataset containing 231 code defect samples. Experimental results demonstrate that AutoVulnFix achieves an average improvement of 4.2 percentage points in repair accuracy

an average reduction of 25.8% in execution time

and an average saving of 21.4% in token consumption. The system provides an effective solution for practical deployment of APR technology.

关键词

Keywords

references

Le Goues C , Nguyen T , Forrest S , et al . GenProg: a generic method for automatic software repair [J ] . IEEE Transactions on Software Engineering , 2012 , 38 ( 1 ): 54 - 72 .

Le Goues C , Holtschulte N , Smith E K , et al . The ManyBugs and IntroClass benchmarks for automated repair of C programs [J ] . IEEE Transactions on Software Engineering , 2015 , 41 ( 12 ): 1236 - 1256 .

Yuan Y , Banzhaf W . ARJA: automated repair of Java programs via multi-objective genetic programming [J ] . IEEE Transactions on Software Engineering , 2020 , 46 ( 10 ): 1040 - 1067 .

Wang Y , Wang W S , Joty S , et al . CodeT5: identifier-aware unified pre-trained encoder-decoder models for code understanding and generation [C ] // Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing . Stroudsburg, PA, USA : ACL , 2021 : 8696 - 8708 .

Fried D , Aghajanyan A , Lin J , et al . InCoder: a generative model for code infilling and synthesis [PP ] . arXivpreprint , 2022 , arXiv: 2204.05999 .

Feng Z Y , Guo D Y , Tang D Y , et al . CodeBERT: a pre-trained model for programming and natural languages [C ] // Proceedings of the Findings of the Association for Computational Linguistics: EMNLP 2020 . Stroudsburg : ACL , 2020 : 1536 - 1547 .

Chen Z M , Kommrusch S , Tufano M , et al . SequenceR: sequence-to-sequence learning for end-to-end program repair [J ] . IEEE Transactions on Software Engineering , 2021 , 47 ( 9 ): 1943 - 1959 .

Lutellier T , Pham H V , Pang L , et al . CoCoNuT: combining context-aware neural translation models using ensemble for program repair [C ] // Proceedings of the 29th ACM SIGSOFT International Symposium on Software Testing and Analysis . New York : ACM , 2020 : 101 - 114 .

White M , Tufano M , Vendome C , et al . Deep learning code fragments for code clone detection [C ] // Proceedings of the 31st IEEE/ACM International Conference on Automated Software Engineering . New York : ACM , 2016 : 87 - 98 .

Zhang Y T , Ruan H F , Fan Z Y , et al . AutoCodeRover: autonomous program improvement [C ] // Proceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis . New York : ACM , 2024 : 1592 - 1604 .

Monperrus M . Automatic software repair: a bibliography [J ] . ACM Computing Surveys , 2019 , 51 ( 1 ): 1 - 24 .

Rao S , Kak A . Retrieval from software libraries for bug localization: a comparative study of generic and composite text models [C ] // Proceedings of the 8th Working Conference on Mining Software Repositories . New York : ACM , 2011 : 43 - 52 .

Zhou J , Zhang H Y , Lo D . Where should the bugs be fixed? More accurate information retrieval-based bug localization based on bug reports [C ] // Proceedings of the 2012 34th International Conference on Software Engineering (ICSE) . Piscataway : IEEE Press , 2012 : 14 - 24 .

Kim D , Nam J , Song J , et al . Automatic patch generation learned from human-written patches [C ] // Proceedings of the 2013 35th International Conference on Software Engineering (ICSE) . Piscataway : IEEE Press , 2013 : 802 - 811 .

Nguyen H D T , Qi D W , Roychoudhury A , et al . SemFix: Program repair via semantic analysis [C ] // Proceedings of the 2013 35th International Conference on Software Engineering (ICSE) . Piscataway : IEEE Press , 2013 : 772 - 781 .

Mechtaev S , Yi J , Roychoudhury A . DirectFix: looking for simple program repairs [C ] // Proceedings of the 2015 IEEE/ACM 37th IEEE International Conference on Software Engineering . Piscataway : IEEE Press , 2015 : 448 - 458 .

Koyuncu A , Liu K , Bissyandé T F , et al . FixMiner: Mining relevant fix patterns for automated program repair [J ] . Empirical Software Engineering , 2020 , 25 ( 3 ): 1980 - 2024 .

Liu K , Koyuncu A , Kim D , et al . TBar: revisiting template-based automated program repair [C ] // Proceedings of the 28th ACM SIGSOFT International Symposium on Software Testing and Analysis . New York : ACM , 2019 : 31 - 42 .

Qi Z C , Long F , Achour S , et al . An analysis of patch plausibility and correctness for generate-and-validate patch generation systems [C ] // Proceedings of the 2015 International Symposium on Software Testing and Analysis . New York : ACM , 2015 : 24 - 36 .

Xia C S , Zhang L M . Automated program repair via conversation: fixing 162 out of 337 bugs for $0.42 each using ChatGPT [C ] // Proceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis . New York : ACM , 2024 : 819 - 831 .

Guo D Y , Lu S , Duan N , et al . UniXcoder: unified cross-modal pre-training for code representation [C ] // Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) . Stroudsburg, PA, USA : ACL , 2022 : 7212 - 7225 .

Yamaguchi F , Golde N , Arp D , et al . Modeling and discovering vulnerabilities with code property graphs [C ] // Proceedings of the 2014 IEEE Symposium on Security and Privacy . Piscataway : IEEE Press , 2014 : 590 - 604 .

Ferrante J , Ottenstein K J , Warren J D . The program dependence graph and its use in optimization [C ] // International Symposium on Programming . Berlin, Heidelberg : Springer , 1984 : 125 - 132 .

Liu T Y . Learning to rank for information retrieval [J ] . Foundations and Trends® in Information Retrieval , 2009 , 3 ( 3 ): 225 - 331 .

Jimenez C E , Yang J , Wettig A , et al . SWE-bench: can language models resolve real-world GitHub issues? [PP ] . arXivpreprint , 2023 , arXiv: 2310.06770 .

Just R , Jalali D , Ernst M D . Defects4 J: a database of existing faults to enable controlled testing studies for Java programs[C ] // Proceedings of the 2014 International Symposium on Software Testing and Analysis . New York : ACM , 2014 : 437 - 440 .

Lin D , Koppel J , Chen A , et al . QuixBugs: a multi-lingual program repair benchmark set based on the quixey challenge [C ] // Proceedings of the Proceedings Companion of the 2017 ACM SIGPLAN International Conference on Systems, Programming, Languages, and Applications: Software for Humanity . New York : ACM , 2017 : 55 - 56 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于隐私集合求交的大模型双向隐私授权

mmDefender: 基于多模态多语言对抗训练的大语言模型增强方法

物联网设备固件自动化漏洞挖掘技术研究综述

“最小必要”原则视角检测移动应用程序的隐私合规性

基于指令与描述的文本数据安全业务属性生成机制