An Insight into Security Code Review with LLMs: Capabilities, Obstacles, and Influential Factors

TL;DR

This study empirically evaluates the effectiveness of seven Large Language Models in security code review, demonstrating their superiority over static analysis tools and analyzing factors influencing their performance.

Contribution

It provides a comprehensive comparison of LLMs and static analysis tools in security defect detection, highlighting the impact of prompts and code characteristics on LLM performance.

Findings

LLMs outperform static analysis tools in security defect detection.

DeepSeek-R1 and GPT-4 are the top performers among evaluated LLMs.

Prompt design and code complexity significantly influence LLM effectiveness.

Abstract

Security code review is a time-consuming and labor-intensive process typically requiring integration with automated security defect detection tools. However, existing security analysis tools struggle with poor generalization, high false positive rates, and coarse detection granularity. Large Language Models (LLMs) have been considered promising candidates for addressing those challenges. In this study, we conducted an empirical study to explore the potential of LLMs in detecting security defects during code review. Specifically, we evaluated the performance of seven LLMs under five different prompts and compared them with state-of-the-art static analysis tools. We also performed linguistic and regression analyses for the two top-performing LLMs to identify quality problems in their responses and factors influencing their performance. Our findings show that: (1) In security code review, LLMs significantly outperform state-of-the-art static analysis tools, and the reasoning-optimized LLM performs better than general-purpose LLMs. (2) DeepSeek-R1 achieves the highest performance, followed by GPT-4 provided in the ChatGPT platform. The optimal prompt for DeepSeek-R1 incorporates both the commit message and chain-of-thought (CoT) guidance, while for GPT-4 via ChatGPT, the prompt with a Common Weakness Enumeration (CWE) list works best. (3) GPT-4 via ChatGPT frequently produces vague expressions and exhibits difficulties in accurately following instructions in the prompts, while DeepSeek-R1 more commonly generates inaccurate code details in its outputs. (4) LLMs are more adept at identifying security defects in code files that have fewer tokens and security-relevant annotations. (5) Higher code complexity correlates with enhanced detection capabilities of DeepSeek-R1 for specific security defect types.