A Cost-Efficient CWE-Grounded Multi-Agent LLM Pipeline for Web and API Vulnerability Analysis: Design, Statistical Evaluation, and Implications for 5G/6G Edge Deployment
Year: 2026
Type: article
Abstract: Software-defined fifth-generation (5G) and sixth-generation (6G) networks expose web and application programming interface layers across distributed edge infrastructure, enlarging the attack surface while commercial static analysis stays costly for small teams. This study introduces a Common Weakness Enumeration (CWE)-based multi-agent pipeline: a detector agent achieves high recall, a validator agent scores candidates, and ambiguous cases are escalated to a human analyst. Escalation is formalized as classification with a reject option, with closed-form thresholds and proof that human review does not reduce precision. The pipeline was evaluated over ten runs on the Spiracle benchmark (blinded re-annotation), and against the OWASP Benchmark, compared to CodeQL, a single-agent configuration, and a rule-plus-large-language-model baseline. Precision reached 83.3% on Spiracle and 0.683 with 0.867 recall on labeled data, costing under $0.10 per scan. Model drift—not sampling temperature—explained most run-to-run variation. The evaluation used Java web code from two benchmarks; no 5G network function was scanned, and a deterministic analyzer outperformed the pipeline on detection.
Language: English
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: gold
Estimated APC paid: $2,075
OpenAlex ID: W7222213279