Enhancing Static Vulnerability Alert Validation Using Large Language Models

As software systems become increasingly complex, security vulnerabilities pose a significant threat to system stability and data integrity. Although traditional static analysis tools can rapidly scan codes for known vulnerability patterns, they frequently exhibit high false positive rates owing to a lack of deep semantic understanding. The structured information provided by code property graphs (CPGs) offers critical context-aware features that can enrich reports generated by static scanners. Therefore, this study proposes a hybrid vulnerability alert validation framework that integrates static analysis, CPGs, and large language models (LLMs) to improve the precision of vulnerability alert validation and provide evidence-grounded diagnostic support. The proposed framework first employs multiple static analysis tools to perform an initial scan for identifying potential vulnerability warnings. Subsequently, the Joern analysis tool converted the relevant code into CPG representations. These structured features, which captured rich syntactic, semantic, and dependency information, were then input into the LLM. Using the code reasoning capabilities of the LLM, the framework performs a fine-grained assessment to confirm the validity of vulnerability alerts and generates evidence-grounded taint-flow explanations. Experimental results demonstrate the effectiveness of the proposed approach that achieved a precision of 96.43% and an F1-score of 87.10% on a controlled SARD dataset. On Devign/FFmpeg, the framework achieved an F1-score of 85.20% and filtered 95.2% of false-positive SAST noise. It also achieved an F1-score of 92.28% on CASTLE, outperforming representative formal verification, SAST, and LLM-based baselines. These results show its practical value in reducing alert fatigue and providing evidence-grounded diagnostic support for vulnerability inspection.