Abstract:

The surging scale and complexity of modern software systems posed severe challenges to traditional static analysis. To address this, this paper systematically reviewed the evolutionary trajectory, core challenges, and state-of-the-art methods in repository-level static vulnerability detection. First, it traced the generational technological evolution from rule-driven traditional static analysis and data-driven machine learning/deep learning to semantics-driven large language model(LLM) and agent, and analyzed the critical role of intermediate representations in cross-file modeling. Then, for repository-level scenarios, it summarized six core challenges, including excessive context scale, fragmented cross-file dependencies, and difficulty in controlling false positives. It systematically evaluated the capability boundaries of technical approaches such as the deep integration of static analysis tools with LLM and collaborative agent-based detection frameworks. Finally, on this basis, it deeply dissected the trustworthiness bottleneck caused by the conflict between probabilistic reasoning and formal constraints, identified several structural limitations in existing datasets, proposed an approach to reconstructing evaluation metrics for engineering effectiveness, and outlined future research directions.

Key words: repository-level static vulnerability detection, large language model, agent, static analysis tool integration