Large language models in source code static analysis

• Main Authors: Ignatyev, V. N., Shimchik, N. V., Panov, D. D., Mitrofanov, A. A.
• Format: Conference Proceeding
• Language: English
• Subjects: Codes; Computer languages; Conferences; Documentation; Large language models; LLM; Source coding; Static analysis; static code analysis; vulnerabilities detection
• ISSN: 2831-5847
• DOI: 10.1109/IVMEM63006.2024.10659715

Applications of Large Language Models (LLM) for source code analysis and related tasks arising during the development of an industrial static analyzer are becoming increasingly relevant due to the rapid development of LLM capabilities. The paper investigates several problems in the field of industrial static analysis, for which the use of LLM may be promising, provides quality evaluation of the results, key limitations and advantages for each one. Among the problems, the detection of "variable misuse" logic errors and the verification of warnings generated by the the static analysis tools are considered. In addition to tasks directly related to source code error detection, several methods have been developed to address supporting tasks in static analysis. These include generating specifications for library functions based on documentation and source code, as well as translating static analyzer tests developed for one programming language into another. All the methods were implemented within the infrastructure of the industrial static analyzer Svace and were tested on the dataset, which is used for Svace evaluation. Conclusions of results evaluation and possible integration to Svace for all proposed methods are discussed in the paper.