The History Is the Detector: Executing CVE Patch History, End-to-End
BUGSTONE-E2E converts CVE patch history into executable LLM-guided detection rules, yielding 1,033 rules and 644 runtime-verified findings across 14 programs.
The BUGSTONE-E2E framework mines reusable detection rules from verified fixing commits, organized by CWE and language, and applies them through a funnel pipeline that escalates from Tree-sitter anchors and lightweight heuristics to LLM-based agent inspection, runtime verification, and scope-checked patch generation. Built from 19,325 high-severity CVEs published 2022-2026, it produced 1,033 detection rules spanning 56 CWE families, packaged into 172 skills. Applied across 14 programs, it generated runtime evidence for 644 findings, demonstrating that vulnerability history can drive reproducible detection and repair.
- Mines scan anchors, fix semantics, and CVE provenance from fixing commits
- Funnel pipeline: Tree-sitter anchors, heuristics, LLM agents, runtime verification
- Generates scope-checked patches validated via two-sided differential testing
- 1,033 rules across 56 CWE families from 19,325 high-severity CVEs
- Products
- BUGSTONE-E2E
From the original article
1 min read at arxiv.orgPublic vulnerability databases collect rich information about known software flaws, including their weakness types, affected components, and related patches. Fixing commits provide the exact code changes that removed these flaws. While these records capture why the original code was unsafe, they are documented mainly for human inspection rather than automated reuse.
By Qiushi Wu · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.