Secure Reviewer: Enhancing Large Language Models for Secure Code Review through Secure-aware Fine-tuning

Revolutionizing Secure Code Review with LLM-Enhanced Automation

This research introduces SECUREREVIEWER, an innovative framework designed to significantly enhance Large Language Models (LLMs) for secure code review. Addressing critical gaps in existing automated tools, SECUREREVIEWER leverages a novel automated data collection and refinement pipeline to build a tailored dataset. It employs a secure-aware fine-tuning strategy to train LLMs for precise identification of security issues and generation of actionable fix suggestions. Furthermore, it integrates Retrieval-Augmented Generation (RAG) to ground comments in domain-specific security knowledge, mitigating common LLM hallucinations. A new evaluation metric, SecureBLEU, is also introduced to accurately assess the effectiveness of comments in addressing security concerns. Experimental results demonstrate that SECUREREVIEWER substantially outperforms state-of-the-art baselines in both security issue detection accuracy and the overall quality and practical utility of generated review comments, marking a significant step forward in proactive software security.