SecPatRec recovers security patterns from code
Original title: A Hybrid Approach for Automated Security Pattern Recovery
SecPatRec uses LLM agent with code search and static graphs to recover security pattern roles, grounding, and interactions from Java and Python repositories.
Security patterns prescribe architectural solutions but are hard to recover from source code. SecPatRec treats patterns as reference architectures and frames recovery as deductive task. It pairs ReAct-style LLM agent for role detection with static code property graph analysis. Ground-truth dataset of 100 instances across 93 repositories. Evaluation shows 0.84 role-detection accuracy and 0.66 interaction score.
- Hybrid LLM and static analysis
- Role-detection accuracy 0.84
- Interaction-recovery score 0.66
- Ground-truth of 100 pattern instances
- 93 Java and Python repositories
From the original article
1 min read at arxiv.orgSecurity-by-design emphasises integrating security into software design and development. Security pattern catalogues operationalise this principle by prescribing reusable architectural solutions to recurring security problems. However, recovering their implementations from source code remains challenging because security patterns are abstract, span multiple components, and admit many valid implementations.
By Anh Minh Nguyen · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.