CWE-Driven C/C++ Vulnerability Remediation
Budget: $250 – $750 USD
I am looking for help to build a cybersecurity pipeline for automated source code vulnerability analysis.
I need an end-to-end architecture that handles detection, localization, explanation, and remediation using a combination of Deep Learning and LLMs, rather than a simple demo.
Technical scope:
DL-Powered Detection & Localization: A multi-class classifier to categorize multi-language code (starting with C/C++) at the function or file level. It must predict whether code is Safe, belongs to specific top CWE classes, or falls into an "Unknown/Other" category. It must also pinpoint suspicious line numbers and code segments.
Code Processing: Use sliding window techniques for long code—no simple truncation.
LLM Explanation Generation: An LLM pipeline to output diagnostic reports. This includes a technical trace of the data flow and root causes mapped to CVE/CWE taxonomies.
Automated Remediation: An LLM, fine-tuned via LoRA, to automatically synthesize secure, logically equivalent code patches for the localized threats.
Dataset: Source, select, and preprocess data from established academic vulnerability datasets, ensuring reasonable class balance and an explanation for the selection.
Evaluation & Deliverables:
Target F1-Score of >80%, alongside high precision and recall.
Metrics (ROC-AUC, Accuracy, Precision, Recall) broken down overall, per-CWE, and per-language.
Visualizations including train/val loss and F1 curves, aggregate validation charts, and confusion matrices.
At least 3 documented experiments tracking major architectural decisions and hyperparameter adjustments.
Reproducible Jupyter notebooks (preprocessing, training, evaluation), documentation, real-world testing results, and final model files.
I need an end-to-end architecture that handles detection, localization, explanation, and remediation using a combination of Deep Learning and LLMs, rather than a simple demo.
Technical scope:
DL-Powered Detection & Localization: A multi-class classifier to categorize multi-language code (starting with C/C++) at the function or file level. It must predict whether code is Safe, belongs to specific top CWE classes, or falls into an "Unknown/Other" category. It must also pinpoint suspicious line numbers and code segments.
Code Processing: Use sliding window techniques for long code—no simple truncation.
LLM Explanation Generation: An LLM pipeline to output diagnostic reports. This includes a technical trace of the data flow and root causes mapped to CVE/CWE taxonomies.
Automated Remediation: An LLM, fine-tuned via LoRA, to automatically synthesize secure, logically equivalent code patches for the localized threats.
Dataset: Source, select, and preprocess data from established academic vulnerability datasets, ensuring reasonable class balance and an explanation for the selection.
Evaluation & Deliverables:
Target F1-Score of >80%, alongside high precision and recall.
Metrics (ROC-AUC, Accuracy, Precision, Recall) broken down overall, per-CWE, and per-language.
Visualizations including train/val loss and F1 curves, aggregate validation charts, and confusion matrices.
At least 3 documented experiments tracking major architectural decisions and hyperparameter adjustments.
Reproducible Jupyter notebooks (preprocessing, training, evaluation), documentation, real-world testing results, and final model files.