DVDR-LLM: When Are LLMs Better Together for Software Vulnerability Detection and Repair?

Official implementation and artifact for the research paper:
"DVDR-LLM: When Are LLMs Better Together for Software Vulnerability Detection and Repair?"

🎯 Overview

DVDR-LLM is an ensemble framework that systematically examines the fundamental trade-offs in aggregating multiple Large Language Models (LLMs) for software vulnerability detection and repair. Our comprehensive evaluation reveals critical insights about precision-recall balancing, model diversity benefits, and consensus-based approaches in security-critical applications.

Key Findings

• Precision-Recall Trade-offs: Ensemble reduces false positives in patch validity assessment (+10-12% accuracy) but increases false negatives in vulnerability identification
• Complexity Benefits: Model diversity advantages increase with code abstraction level (+18% recall, +11.8% F1 for multi-file vulnerabilities)
• Conservative Bias: 80% of models exhibit systematic conservative behavior (missing vulnerabilities vs. over-detection)
• No Unique Specialists: All vulnerability detections overlap across the ensemble, validating majority voting strategies

📁 Repository Structure

DVDR_LLM/
├── dvdr_llm/                  # Main package (professional structure)
│   ├── __init__.py            # Package exports
│   ├── cli.py                 # Command-line interface
│   ├── config.py              # Configuration settings
│   ├── core/                  # Core functionality
│   │   ├── api_client.py      # LLM API communication
│   │   ├── detector.py        # VulnerabilityDetector class
│   │   └── prompts.py         # Prompt generation utilities
│   ├── analysis/              # Analysis modules
│   │   ├── consensus.py       # Consensus analysis
│   │   └── metrics.py         # Performance metrics
│   ├── evaluation/            # Model evaluation
│   │   └── evaluator.py       # ModelEvaluator class
│   ├── visualization/         # Plotting and visualization
│   │   └── plotter.py         # ResultsPlotter class
│   └── tools/                 # Additional utilities
├── utils/                     # Original utility modules
│   ├── api.py                 # LLM API interaction helpers
│   ├── database.py            # SQLite helper functions
│   └── config.py              # Configuration constants
├── data/                      # Datasets and databases
│   ├── vulnerabilities.csv    # Vulnerability data
│   └── vulnerable and patched codes.sqlite
├── output/                    # Generated results and databases
│   ├── database_*.sqlite      # Model-specific databases
│   ├── consensus_analysis/    # Consensus analysis results
│   ├── metrics/              # Performance metrics
│   └── database_exports/     # Exported data
├── examples/                  # Usage examples
│   └── basic_usage.py         # Basic usage demonstration
├── docs/                      # Documentation
│   └── README_consensus_analysis.md
├── paper/                     # Research paper
│   ├── main.pdf               # Published paper
│   └── main.tex               # LaTeX source
├── setup.py                   # Package installation
├── requirements.txt           # Dependencies
├── CHANGELOG.md              # Change log
├── LICENSE                   # MIT License
└── README.md                 # This file

🚀 Quick Start

Prerequisites

• Python 3.8+
• Access to LLM APIs (Ollama, OpenAI, etc.)
• SQLite for vulnerability databases

Installation

1. Clone the repository:

   git clone https://github.com/Erroristotle/DVDR_LLM.git
   cd DVDR_LLM
   

2. Install dependencies:

   pip install -r requirements.txt
   pip install -e .  # Install package in development mode
   

3. Verify installation:

   python verify_package.py
   

Basic Usage

Command Line Interface

# Run vulnerability detection with ensemble
dvdr-llm detect --models llama3-8b,codellama-7b --database data/vulnerabilities.sqlite

# Analyze consensus patterns (RQ2)
dvdr-llm analyze consensus --input results/metrics/model_predictions.csv --threshold 0.6

# Generate conflict pattern visualization (Figure in paper)
python dvdr_llm/visualization/conflict_pattern_plot.py results/metrics/reviewer_insights_disagreement_patterns.csv -o reviewer_insights

# Evaluate ensemble performance across abstraction levels (RQ3)
dvdr-llm evaluate --models-dir output/ --abstraction-analysis

Python API

from dvdr_llm import VulnerabilityDetector, ConsensusAnalyzer, ModelEvaluator

# Initialize vulnerability detector
detector = VulnerabilityDetector("llama3-8b-instruct")

# Connect to database
detector.connect_to_database("data/vulnerabilities.sqlite")

# Analyze code for vulnerabilities
code = """
void vulnerable_function(char *input) {
    char buffer[100];
    strcpy(buffer, input);  // Buffer overflow
}
"""

# Get CVE predictions
cve_names = detector.analyze_code_for_cves(code, 2023)
print(f"Identified CVEs: {cve_names}")

# Detect vulnerability
is_vulnerable = detector.detect_vulnerability(code)
print(f"Is vulnerable: {is_vulnerable}")

# Process database entries
stats = detector.process_database_entries(limit=100)
print(f"Processed {stats['processed']} entries")

# Clean up
detector.close()

# Multi-model consensus analysis
model_databases = {
    "llama3-8b": "output/database_llama3-8b-instruct.sqlite",
    "codellama-7b": "output/database_codellama-7b-instruct.sqlite",
    "gemma2-9b": "output/database_gemma2-9b.sqlite"
}

analyzer = ConsensusAnalyzer()
consensus_results = analyzer.run_full_analysis(model_databases)

# Model evaluation
evaluator = ModelEvaluator()
evaluation_results = evaluator.evaluate_multiple_models(
    model_databases, 
    "data/ground_truth.csv"
)

📊 Reproducing Paper Results

Research Questions

RQ1: Impact of Aggregating Multiple LLMs

# Generate Table 2 (Model comparison with delta percentages)
python dvdr_llm/tools/model_contribution_analysis.py results/metrics/model_predictions.csv --compare-ensemble --threshold 0.7

# Analyze individual vs ensemble performance
dvdr-llm evaluate --comparison-analysis --threshold 0.7

RQ2: Optimal Consensus Threshold

# Generate Figure 3 (Threshold sensitivity analysis)
python dvdr_llm/tools/threshold_analysis.py results/metrics/model_predictions.csv --range 0.3-0.8

# Statistical validation of threshold selection
python dvdr_llm/analysis/statistical_validation.py --threshold-analysis

RQ3: Performance Across Abstraction Levels

# Generate Table 3 (Abstraction level analysis)
python dvdr_llm/evaluation/evaluator.py --abstraction-analysis --threshold 0.6

# Level-specific performance evaluation
dvdr-llm evaluate --abstraction-levels 1,2,3 --ensemble

RQ4: Weighted Aggregation for Patch Quality

# Analyze patch quality metrics (ROUGE, CodeBLEU, Complexity)
python dvdr_llm/tools/patch_quality_analysis.py results/patches/ --weighted-scoring

# Generate Figure 4 (Patch similarity and complexity analysis)
dvdr-llm visualize --patch-analysis --metrics results/patch_metrics.csv

Key Figures Generation

# Main conflict pattern analysis figure (Figure 2)
python dvdr_llm/visualization/conflict_pattern_plot.py results/metrics/reviewer_insights_disagreement_patterns.csv -o reviewer_insights

# Threshold sensitivity analysis (Figure 3)
python dvdr_llm/visualization/enhanced_figure3_generator.py results/metrics/model_predictions.csv

# Statistical validation plots (Appendix)
python dvdr_llm/analysis/statistical_significance_analysis.py --generate-plots

🔧 Configuration

Model Configuration

Edit dvdr_llm/config.py to configure LLM endpoints: