NDSS 2025 – The Midas Touch: Triggering The Capability Of LLMs For RM-API Misuse Detection

Why It Matters

Accurate RM‑API misuse detection prevents severe vulnerabilities such as denial‑of‑service and memory corruption, directly improving software reliability. This work showcases how large language models can be harnessed beyond code generation to enhance automated security tooling, marking a timely shift toward AI‑driven vulnerability discovery.

Summary

The episode presents ChatDetector, a novel LLM‑empowered system for detecting misuse of resource‑management APIs (RM‑APIs) in open‑source software. By leveraging a ReAct‑inspired chain‑of‑thought prompting framework and cross‑validation techniques, ChatDetector overcomes LLM hallucinations to accurately extract allocation/release API pairs and constraints, achieving 98.21% precision and uncovering 115 critical bugs. The authors—Yi Yang, Jinghua Liu, Kai Chen, and Miaoqian Lin—demonstrate how this approach retrieves far more RM‑API constraints than traditional methods, highlighting the potential of LLMs in security analysis.