BugAuditor - BugAuditor: Detecting Bugs via Inconsistent Defens

项目说明

BugAuditor

BugAuditor is an LLM-driven bug detection framework that uses inconsistent defensi as a new oracle for detecting project-specific bugs. Its key insight is that large software systems already contain abundant defensive code, where de apply defensi to prevent bugs in security-sensiti. When similar security-sensiti are handled defensively in some places but not in others, the inconsistency may indicate a real bug.

BugAuditor first identifies defensive code snippets across the codebase, then infers defensi that capture both the security-sensiti and the required defensi. It finally applies these patterns to audit similar code contexts and detect missing or inconsistent handling.

Please refer to our paper for more details.

Intro

The following are key concepts in BugAuditor.

<di="center">

| Key Concept | Description |
| -------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| defensi | Defensi that de use to prevent bugs in security-sensiti (e.g., kfree, clk_put, and null-pointer checks). |
| security-sensiti | Behaviors that are inherently error-prone and require proper handling, as improper or missing handling may lead to security bugs. |
| defensi | Characterizes security-sensiti and their corresponding defensi within a defensive code snippet. |
| bug auditing | Uses mined defensi to detect inconsistent handling of security-sensiti across similar functions. |

</div>

Workflow

<p align="center"><img src="paper/BugAuditor_o.jpg" width="700"></p>

As shown in the figure, BugAuditor detects potential bugs by finding inconsistent defensi in similar security-sensiti.

The process can be summarized as follows:

| Stage | Core task | Output |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------- |
| Defensive code collecting | Collect defensive code snippets around seed defensi, and expand to related project-specific defensi when needed. | A curated set of defensive code snippets. |
| Defensi reasoning | Infer defensi that connect security-sensiti with corresponding defensi from collected snippets. | Inferred defensi. |
| Bug auditing | Apply inferred patterns to comparable functions and detect inconsistent defensi. | Bug reports with explanations. |

Repository layout

Artifact e

Please refer directly to AE.md for the instructions and ignore the instructions below.

Usage

Install and configure

1. Build and enter the Docker image:

2. Download or clone your project source code to a local directory.

3. Edit config.json with the source path and your LLM endpoint.
4. Check the setup for your repo.

Quick functional test

We provide a packaged small example for quick functional testing to that the installation and configuration are successful.
In this example, we use clk_put as the seed defensi and analyze the Linux kernel, using a few examples for testing.

1. Pattern Reasoning

1. Bug Auditing

If you are interested in more details about this functional test (e.g., reference output and execution time), you may refer to the Minimal Functional Example section in AE.md.

Running Example on the Linux Kernel

To use BugAuditor, you can provide the corresponding defensi along with the target source code repository for analysis. This process in two main stages: defensi reasoning and bug auditing.
Here, we demonstrate how to configure BugAuditor using a concrete example from the Linux kernel (using repository linux and defensi clk_put)

The parameters can be adjusted according to your specific needs.

Run defensi reasoning.

This writes mined patterns to:

Run bug auditing with inferred pattern file.

For a fast example, use the packaged clk_put patterns file:

If you ran Step 1 and want to use the newly mined patterns instead, pass that file explicitly:

Main output:

Packaged reference files:

Mined patterns: inferred_defensi.json

Example bug reports: bug_reports_clk_put.json

Running Example on the OpenSSL

OpenSSL follows the same workflow.
First make sure config.json:program_paths.openssl points to the OpenSSL source tree:

To mine patterns:

To run a quick audit with a packaged pattern file:

Packaged pattern file: openssl_OPENSSL_free_patterns.json

Running BugAuditor on your own project

1. Add your project path to config.json.

2. Check the setup:

3. Mine patterns for the defensi you want to audit:

5. Audit with an explicit pattern file:

Other details

For more details about reproducibility or extensibility (e.g., defensi extensibility), you may refer to AE.md.

Contact

If you encounter any issues or ha, we would be grateful for your feedback. Please feel free to contact the authors.
Email:

项目信息

开发语言：Python

Star 数：5

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕BugAuditor: Detecting Bugs via Inconsistent Defensive Code Auditing (USENIX Security 2026)展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。