DeepTriFix: An LLM-Based Code Defect Detection Framework Guided Abstract Syntax Tree and Prompt Reasoning

To address the limitations of traditional deep learning methods in code defect detection—particularly in terms of feature extraction and generalization—this paper proposes DeepTriFix, a three-stage framework leveraging large language models (LLMs). DeepTriFix integrates syntax-aware analysis with semantic reasoning to achieve accurate and explainable defect detection. In the first stage, Tree-sitter is used to construct Abstract Syntax Trees (ASTs) and identify source values associated with three critical memory defects: memory leaks (MLK), null pointer dereference (NPD), and use-after-free (UAF). In the second stage, customized prompt templates are constructed based on defect locations, guiding the DeepSeek LLM to assess vulnerability types and generate human-interpretable rationales. Finally, a LoRA-fine-tuned Qwen2.5-Coder-7B model is employed to detect additional types of defects beyond the predefined categories. Experimental results on the Devign dataset demonstrate that DeepTriFix achieves an accuracy of 67.6%, outperforming CodeT5 by 1.8%, and showing superior capability in defect detection and interpretability under complex contexts. This work highlights the effectiveness of combining structured syntax analysis with LLM reasoning for automated and high-precision software vulnerability detection.