AI That Detects, Validates, and Repairs
Open Access DepositedA Cross-Language Autonomous Vulnerability Lifecycle Framework
Software vulnerabilities remain critical threats to modern computing systems, yet existing detection tools operate in isolation, producing high false-positive rates and lacking exploitability confirmation. This thesis presents a unified cross-language vulnerability lifecycle framework integrating detection, validation, and remediation through Universal Abstract Syntax Tree (uAST) normalization and hybrid AI reasoning. The framework achieves 89.84–92.02% detection accuracy through structural-semantic fusion, with cross-language transfer F1 scores of 74.43–78.18% demonstrating meaningful zero-shot generalization across Java, Python, and C++. Execution-based validation confirms 66.84–71.49% of genuine vulnerabilities while rejecting 58.72–62.37% of detector false positives. Iterative repair succeeds in 81.37–87.27% of cases, converging in 2.3–3.4 iterations, with end-to-end pipeline integration resolving 69.74% of vulnerabilities at 12.27% total failure rate. Ablation studies validate architectural necessity
removing Universal AST degrades cross-language performance by 23.42%, while disabling validation increases unnecessary repairs by 131.7% and reduces end-to-end success by 9.56 percentage points. Operating with lightweight locally-deployed models (~3GB footprint), the framework processes 1,700–2,400 samples daily on consumer-grade GPUs, enabling practical CI/CD integration without cloud dependencies. This demonstrates that scalable multi-language security lifecycle management is achievable through principled integration of structural abstraction, semantic reasoning, and execution-based evidence.
- All rights reserved
Notice to Authors
If you are the author of this work and you have any questions about the information on this page, please use the Contact form to get in touch with us.