Enhancing Static Analysis for Practical Bug Detection: An LLM-Integrated Approach
summary
A framework called LLift combines an existing static checker (UBTag) with iterative LLM queries to resolve UBTag’s 53k “undecided” paths, using post-constraint guided path analysis to prune paths and a progressive prompt that asks for function summaries until confident. Implemented on Linux kernel code, it turns many timeouts into decisive answers, finds 13 true positives in 1,000 surveyed undecided cases and surfaces four previously unknown use‑before‑init bugs that the Linux community confirms.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 0:23LLMs with static analysis
- 1:49LLMs challenges and potential
- 3:12UBI bug detection in Linux kernel
- 4:38Static analysis limitations
- 6:29LLM advantage example
- 7:12ALIFT for undecided cases
- 8:38ALIFT design principles
- 10:04Post-content path analysis
- 11:09Evaluation methodology
- 12:57Summary
- 13:38Q&A
related talks
23mInterleaving Static Analysis and LLM Prompting
21mBalancing Analysis Time and Bug Detection: Daily Development-friendly Bug...
15mInterleaving Large Language Models for Compiler Testing
52mFinding Bugs Using Path-Sensitive Static Analysis
59mUnder-approximation for Scalable Bug Detection
18mPreview: Verification (Correctness & Debugging)
58mSecurity Static Analysis - Avoiding an Angry Mob of Engineers
50mPractical Advanced Static Analysis