Year: 2026
Type: dissertation
Abstract: Software systems keep getting more complex, and the number of reported software vulnerabilities keeps rising. Traditional security analysis methods, including manual code review and static analysis, are often insufficient to address these challenges efficiently and cost-effectively. They also report findings without the context needed to judge exploitability, which leaves much of the explanation work to human reviewers. Large language models (LLMs) and multi-agent systems open new directions for automated vulnerability analysis, because these agents can divide the task of gathering, interpreting, and reporting findings between them. This thesis aims to design an artificial intelligence-based multi-agent system architecture that supports automated source code analysis enriched with public vulnerability data. The scope of the work focuses on defining architectural components and agent roles rather than evaluating detection accuracy. The research follows the Design Science Research methodology. The process includes problem identification, the definition of solution objectives, the design and development of the artifact, its demonstration through a proof of concept (PoC) implementation, and the communication of the results. The artifact was designed based on existing research in software security, multi-agent systems, and vulnerability standards, and is realized through an LLM-based multi-agent implementation that demonstrates feasibility. In the implementation, source code findings are classified against Common Weakness Enumeration categories, while Common Vulnerabilities and Exposures identifiers are attached to outdated third-party dependencies found in the target repository. This study proposes an architecture that specifies key components and agent roles of an automated code analysis system that is enriched with public vulnerability data, and the practical viability is confirmed through the PoC. The findings indicate that the approach can support the development of adaptable threat-detection pipelines, particularly in settings where an organization prefers to assemble its own analysis pipeline from open components rather than use a closed commercial product. Further work is needed to validate the architecture against larger codebases and to measure its effectiveness in real development workflows.
Source: Osuva (University of Vaasa)
Author: Sydänmaa, Justus
Language: English
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7197071438