QRS: Neuro-Symbolic Framework for Autonomous CodeQL Synthesis

The QRS (Query, Review, Sanitize) framework addresses the "Expert Bottleneck" in Static Application Security Testing (SAST) by transitioning LLMs from post-hoc triage to the generative core of the discovery pipeline. By autonomously synthesizing CodeQL queries via a neuro-symbolic triad, QRS enables the discovery of novel vulnerability patterns without manual query authorship. Testing on PyPI and CWE-Bench demonstrated high accuracy (up to 94.06%) and the identification of 41 vulnerabilities in Python, including 8 new CVEs. The system integrates a PoC generator to validate findings, significantly reducing false positives compared to traditional pattern-matching SAST tools.

• Research Overview: Solving the Expert Bottleneck

  • Addresses the critical limitation where SAST efficiency depends on manually crafted, expert-level queries.
  • Shifts LLM utility from result-analysis (triage) to logic-generation (query synthesis).
  • Combines neural generation (LLMs) with symbolic reasoning (CodeQL) to identify non-predefined vulnerability classes.

• Methodology: The Neuro-Symbolic Triad

  • Query Agent: Utilizes structured schemas and few-shot learning to autonomously generate precise, executable CodeQL queries.
  • Review Agent: Employs semantic reasoning on query hits to filter false positives and validate the logical flow of the discovery.
  • Sanitize Agent: Manages the verification lifecycle, refining findings and driving an automated PoC exploit generator for empirical validation.

• Technical Highlights & Performance Data

  • Python (PyPI) Impact: Achieved 94.06% verdict accuracy, discovering 41 vulnerabilities, including 8 previously undocumented CVEs.
  • Java (CWE-Bench) Impact: Recorded a 64.44% CVE detection rate with 87.60% accuracy and a high recall of 98.79%.
  • Operational Efficiency: Demonstrated low time overhead and sustainable token costs for large-scale codebase analysis.

• Industry & Defense Implications

  • Reduces systemic reliance on highly specialized security researchers for writing complex static analysis rules.
  • Enables the autonomous discovery of "zero-day" patterns that typically evade industry-standard pattern matching.
  • Provides a scalable blueprint for "self-evolving" SAST tools that adapt detection logic to specific codebase architectures.

• Conclusion: The Future of Autonomous Discovery

  • Validates that neuro-symbolic AI can automate the most labor-intensive phase of vulnerability research.
  • Integration of semantic validation (PoC generation) effectively solves the historical industry issue of SAST false-positive fatigue.