Kaynak Kod Güvenlik Açıklarının Tespiti, Açıklanması ve Giderilmesine Yönelik Çok Kipli Bir Yaklaşım

---

Tezin Türü: Bütünleşik Doktora

Tezin Yürütüldüğü Kurum: Orta Doğu Teknik Üniversitesi, Mühendislik Fakültesi, Bilgisayar Mühendisliği Bölümü, Türkiye

Tezin Onay Tarihi: 2026

Tezin Dili: İngilizce

Öğrenci: İBRAHİM TARAKCI

Asıl Danışman (Eş Danışmanlı Tezler İçin): Mehmet Halit S. Oğuztüzün

Eş Danışman: Selma Nazlıoğlu

Özet:

This thesis develops a multimodal approach to source code vulnerability detection, explanation, and mitigation. It investigates complementary software representations, including source code, general-purpose, security-aware, and taint-based metrics, together with functional and security-oriented summaries generated by large language models (LLMs). These representations are evaluated independently and through multimodal fusion using classical machine learning models, deep learning architectures, pretrained code models, and LLMs. The study also examines dataset quality, duplicate and near-duplicate samples, class imbalance, cross-dataset generalization, and robustness under semantic-preserving code transformations.{\n}{\n}The later stages extend vulnerability detection toward structured explanation and LLM-assisted mitigation. Multimodal evidence is used to generate explanations containing a vulnerability summary, the likely root cause, vulnerability mechanism, trigger conditions, a predicted Common Weakness Enumeration (CWE) category, likely security consequences, and supporting evidence derived from source code, generated summaries, metric attributions, and detector alignment. These explanations guide candidate repair generation, while independent validation evaluates structural integrity, semantic alignment with the identified weakness, repair intent, and consistency with available security evidence.{\n}{\n}The selected components are integrated into VulAREL (Vulnerability Assessment, Repair, and Explanation across Learning Models), a traceable, function-level framework connecting multimodal detection, structured explanation, and candidate repair while separating generation from hidden-reference evaluation. The findings show that the value of multimodal evidence varies across tasks, datasets, and model families; explanation-guided mitigation is more effective than code-only mitigation; and generated repairs require independent validation and human oversight. Overall, the thesis provides a practical, auditable, and comprehensive framework for source code vulnerability analysis.