LLM Augmented Static Vulnerability Detection via Risk-Guided Prompt Fusion

리스크 기반 프롬프트 퓨전을 통한 LLM 보강 정적 취약점 탐지

Static analysis tools such as Joern can scale to large codebases, yet their purely structural reasoning often yields low precision and recall on real-world vulnerabilities. Recent large language models (LLMs) excel at code understanding, but retraining such models is costly and time-consuming. We present a training-free hybrid pipeline that couples Joern with prompt-based inference from GPT-4.1-nano. After a static scan, functions are routed to the LLM based on Joern's risk score, and their predictions are merged via one of three rule-based strategies. On the Big-Vul dataset, our hybrid more than doubles recall and F1 over Joern, while also improving precision - all without updating model weights. While it still trails fine-tuned models like CodeBERT, the proposed method provides a practical and deployable enhancement for vulnerability detection when full fine-tuning is infeasible. Future work will embed graph-based context and explore ensembles that marry LLM adaptability with structure-aware precision.