Comparative evaluation of the performance of generative artificial intelligences and traditional tools in JavaScript source code analysis - Pimentel, Rayane; Progetti, Claudia Bianchi (Companion Proceedings of the Brazilian Symposium on Cybersecurity (SBSeg); 2025: Companion Proceedings of the 25th Brazilian Symposium on CybersecurityDO - 10.5753/sbseg_estendido.2025.11655, 2025)
Comparative study between SAST tools (Semgrep/SonarQube) and LLM models (DeepSeek/CodeLlama) for detecting JavaScript vulnerabilities (OWASP Juice Shop). Results reveal complementarity: SASTs achieve 100% precision for standard vulnerabilities (XSS/SQLi), while LLMs offer higher recall (70% in DeepSeek) for contextual threats (NoSQLi/access control). The 2245% false positive rate in LLMs calls for filtering strategies. We demonstrate that hybrid pipelines optimally combine SAST accuracy with LLM coverage. The study contributes empirical evidence for the adoption of LLMs in security pipelines, highlighting challenges such as the mitigation of false positives.