Name: LLMs as adaptive query planners for SAST
Start: 2026-10-06T14:00:00+0300
End: 2026-10-06T14:45:00+0300

LLMs as adaptive query planners for SAST

Tuesday October 6, 2026 14:00 - 14:45 IDT

Keynote Hall

>> Problem:
Static analysis produces vast amounts of semantic data.
Effectively exploring it remains an open challenge.

>> Why naive LLM approaches fall short:
LLMs can not ingest entire repositories.
They are fundamentally constrained by context limits.
Even the most powerful models cannot reason over thousands of files and millions of tokens. Raw source code seems like the wrong abstraction layer for finding vulnerabilities.

>> Our approach:
Use LLMs as adaptive query planners over a language-agnostic semantic interface. The model incrementally enumerates endpoints, traces data flows, refining its strategy based on solver feedback.

Starting from an empty context, the LLM planner interprets solver responses as either positive or negative signals.

Positive signals include fast query resolution times, indicative naming patterns of functions and variables, and relevant constant strings or regular expressions.

Negative signals include deep class inheritance hierarchies, heavy method overriding, and high-cardinality "fan-in" regions.

These signals allow the planner to balance vulnerability likelihood against exploration cost

>> Advantages:
- reducing context window dramatically
- full observability through inspection of chosen queries
- compliance-friendly: auditable and reproducible analysis
- future work: learn from logs of query strategies

>> Open source implementation:
- The solver and semantic interface are open source: https://dhscanner.org/docs/

>> Evaluation:
- discovery of a previously unknown vulnerability in a highly starred open-source Typescript repo ( confirmed by the maintainers and fixed upstream: https://github.com/formbricks/formbricks/releases/tag/4.0.0 - security section ).

Speakers

Oren Ish-Shalom

Researcher

So ... Hi ! If you're reading this there is a good chance you're coming to OWASP IL 26 - excellent ! Over the years, I've had the opportunity of speaking at international conferences, but for me, nothing is more exciting than giving a talk right here at home. The heat, the humidity... Read More →

Tuesday October 6, 2026 14:00 - 14:45 IDT
Keynote Hall

Keynote hall

AppSec Israel 2026

Oren Ish-Shalom

Get help with the event

AppSec Israel 2026

Oren Ish-Shalom

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

Get help with the event