Optimizing Snyk AI Results with Large Language Model (LLM) to Validate False Positive Rate

Improving Accuracy of OWASP Dependency-Check Through Optimized CPE Matching to Reduce False Positives and False Negatives

In today’s digital era, the use of open-source dependencies in modern software development has become commonplace. However, this practice increases security risks due to vulnerabilities hidden within the open-source components being used. Software Composition Analysis (SCA) is one of the approaches that can be utilized to detect and mitigate the risks arising from the use of open-source dependencies. Nevertheless, existing SCA tools still face a fundamental challenge in the form of false positives (reported vulnerabilities that are not actually relevant) and false negatives (vulnerabilities that remain undetected), which can degrade the accuracy of detection results and hinder security analysis as well as mitigation decisions. This study focuses on improving the accuracy of one widely used SCA tool, OWASP Dependency-Check, by highlighting one of its main sources of error: the Common Platform Enumeration (CPE) matching process between project dependencies and vulnerability entries in the Common Vulnerabilities and Exposures (CVE) database. The objectives of this research are to analyze CPE matching error patterns, design optimization mechanisms to improve the matching process, and evaluate the impact of these optimizations.

LLM-Based Detection and Test Generation for Command Injection Vulnerabilities in Python

Command injection vulnerabilities remain a significant security threat in dynamic languages such as Python, particularly in widely used open-source projects. Recent advances in large language models (LLMs) have shown strong potential in code-related tasks, motivating their application to vulnerability detection.In this paper, we evaluate LLM-based approaches for detecting command injection vulnerabilities and generating security tests. We apply our method to six widely used GitHub projects—Django, Flask, TensorFlow, Scikit-learn, PyTorch, and LangChain—covering over 50,000-star repositories with broad real-world usage. Our study analyzes the effectiveness of LLMs in terms of detection accuracy, efficiency, and practical applicability.We further compare multiple LLMs to assess their relative performance in vulnerability detection and test generation. The results demonstrate that LLM-based approaches can effectively identify vulnerabilities in both complete and fragmented code while providing executable security tests for validation. Our findings highlight the strengths and limitations of LLMs and offer practical insights for leveraging them to enhance automated software security testing.

SNIPTEST: Fuzzing Multi-Level Code Slices for Validating Vulnerabilities

SNIPTEST is an execution-based warning triage framework that generates and fuzzes compiled code slices centered around static-analysis warnings that employs a layer-by-layer slicing strategy, incrementally expanding context around the target location to validate potential vulnerabilities with increasing precision.

CWEEP: A Lexical Static Analysis Framework for CWE Early Prevention

CWEEP can identify the exact location in the RTL where the potential vulnerability resides and supports automatic code repair suggestions when applicable, so it can be used in the early stages of RTL development while properties are still under construction.

Research on a hybrid approach to detecting software code vulnerabilities using LLM in combination with SAST tools

Static Code Analysis Framework for Automated Security Vulnerability Detection

Experimental results show that AST-based structural features substantially improve recall compared with the TF-IDF baseline, while the combined TF-IDF and AST representation maintains this improved performance.