Static Analysis Meets Artificial Intelligence: A Hybrid Framework for PHP Vulnerability Detection Using DeepSeek LLM and Machine Learning
Article Sidebar
Main Article Content
The fast adoption of Large Language Models (LLMs) for code generation has revolutionised the process of constructing online applications; nevertheless, the security implications of AI-generated PHP code are still not fully understood. Combining static analysis, machine learning, and LLM-driven intelligence, this research provides a comprehensive hybrid vulnerability detection system that can identify security weaknesses in PHP web applications. The method is designed to identify vulnerabilities in PHP web applications. Utilising eleven different vulnerability categories that are connected to the CWE and OWASP Top 10 standards, our system is more secure. In addition, a trainable Random Forest classifier that utilises TF-IDF vectorisation is utilised, and DeepSeek LLM is incorporated for the purpose of providing intelligent explanations and remediation guidance. We demonstrate that the framework finds 15 vulnerabilities across 8 CWE categories from a single configuration file by conducting exhaustive assessments on vulnerable PHP code samples. As a result, the framework achieves a Security Score of 62%. A total of eight medium vulnerabilities, two critical vulnerabilities (SQL Injection), four high vulnerabilities (Hardcoded Credentials, Authentication Bypass, and Broken Access Control), and one low vulnerability were discovered by the static analysis engine. With the help of DeepSeek, the neuro-symbolic pattern generating component was able to attain an average accuracy of 76.6% while simultaneously lowering the amount of time required to produce patterns from weeks to hours. Authentication Security (0%-27% coverage) and HTTP Security Headers (0% coverage) were found to have major gaps in coverage due to the risk assessment that was conducted across five different LLM models. The fact that the whole open-source Streamlit application provides interactive vulnerability reporting along with the ability to export in both JSON and HTML demonstrates that hybrid AI-driven static analysis is an essential tool in contemporary DevSecOps workflows.
Downloads
References
W3Techs, "Usage statistics and market share of PHP for websites," 2024. [Online]. Available: https://w3techs.com/technologies/details/pl-php
CVE Numbering Authorities (CNAs), "CVE Statistics," 2024. [Online]. Available: https://www.cve.org/programorganization/cnas
IBM, "What is the Log4j Vulnerability?," 2024. [Online]. Available: https://www.ibm.com/think/topics/log4j
Al-Suqri MN, Gillani M. A comparative analysis of information and artificial intelligence toward national security. Ieee Access. 2022 Jun 16;10:64420-34.
S. Phanireddy, "Securing Modern Web Applications Using AI-Driven Static and Dynamic Analysis Techniques," International Journal of Artificial Intelligence and Data Science, vol. 6, no. 2, pp. 1-10, 2025.
OpenAI, "Introducing ChatGPT," 2022. [Online]. Available: https://openai.com/blog/chatgpt
Shani I. Survey reveals AI’s impact on the developer experience| The GitHub Blog. GitHub Blog (June 2023) [Internet]. 2023 Available: https://github.blog/2023-06-13-survey-reveals-ais-impact-on-the-developer-experience
J. Savelka, A. Agarwal, C. Bogart, Y. Song, and M. Sakr, "Can Generative Pretrained Transformers (GPT) Pass Assessments in Higher Education Programming Courses?," in Proceedings of the 2023 Conference on Innovation and Technology in Computer Science Education V.1, 2023, pp. 117-123.
S. Dou et al., "What's Wrong with Your Code Generated by Large Language Models? An Extensive Study," arXiv preprint arXiv:2407.06153, 2024.
M. Dakhel et al., "GitHub Copilot AI pair programmer: Asset or Liability?," arXiv preprint arXiv:2206.15331, 2023.
R. Tóth, T. Bisztray, and L. Erdődi, "LLMs in web development: Evaluating LL-generated PHP code unveiling vulnerabilities and limitations," in International Conference on Computer Safety, Reliability, and Security, 2024, pp. 425-437.
N. Perry, M. Srivastava, D. Kumar, and D. Boneh, "Do Users Write More Insecure Code with AI Assistants?," in Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, 2023, pp. 2785-2799.
B. Chess and G. McGraw, "Static analysis for security," IEEE Security & Privacy, vol. 2, no. 6, pp. 76-79, 2004.
X. Rival and K. Yi, Introduction to static analysis: an abstract interpretation perspective. MIT Press, 2020.
B. Johnson, Y. Song, E. Murphy-Hill, and R. Bowdidge, "Why don't software developers use static analysis tools to find bugs?," in 2013 35th International Conference on Software Engineering (ICSE), 2013, pp. 672-681.
P. Emanuelsson and U. Nilsson, "A comparative study of industrial static analysis tools," Electronic Notes in Theoretical Computer Science, vol. 217, pp. 5-21, 2008.
Russo and A. Sabelfeld, "Dynamic vs. static flow-sensitive security analysis," in 2010 23rd IEEE Computer Security Foundations Symposium, 2010, pp. 186-199.
Z. Sheng et al., "LLMs in Software Security: A Survey of Vulnerability Detection Techniques and Insights," ACM Computing Surveys, vol. 58, no. 5, Article 134, 2025.
Z. Li et al., "Vuldeepecker: A deep learning-based system for vulnerability detection," arXiv preprint arXiv:1801.01681, 2018.
Z. Li et al., "Sysevr: A framework for using deep learning to detect software vulnerabilities," IEEE Transactions on Dependable and Secure Computing, vol. 19, no. 4, pp. 2244-2258, 2021.
DeepSeek, "DeepSeek API Platform," 2024. [Online]. Available: https://platform.deepseek.com/
DeepSeek-AI, "DeepSeek-V3: Technical Report," arXiv preprint arXiv:2412.19437, 2024.
S. Phanireddy, "API Security: Offensive and Defensive Strategies," International Journal of Innovative Research and Creative Technology, vol. 10, no. 4, pp. 1-6, 2024.
Li Z, Zou D, Xu S, Jin H, Zhu Y, Zhang Y, Chen Z, Li D. Vuldeelocator: A deep learning-based system for detecting and locating software vulnerabilities. IEEE Transactions on Dependable and Secure Computing. 2021 Jan.
Li Z, Zou D, Xu S, Jin H, Zhu Y, Chen Z. Sysevr: A framework for using deep learning to detect software vulnerabilities. IEEE Transactions on Dependable and Secure Computing. 2021 Jan 13;19(4):2244-58.
Y. Zhou et al., "Devign: Effective Vulnerability Identification by Learning Comprehensive Program Semantics via Graph Neural Networks," in Advances in Neural Information Processing Systems, 2019.
Li Z, Zou D, Xu S, Chen Z, Zhu Y, Jin H. Vuldeelocator: a deep learning-based fine-grained vulnerability detector. IEEE Transactions on Dependable and Secure Computing. 2021 Apr 27;19(4):2821-37.
X. Wang et al., "AutoVulnPHP: A Framework for Automated PHP Vulnerability Detection," arXiv preprint, 2024. https://arxiv.org/abs/2601.06177
Li P, Yao S, Sarfati Korich J, Luo C, Yu J, Cao Y, Yang J. Automated static vulnerability detection via a holistic neuro-symbolic approach. arXiv e-prints. 2025 Apr:arXiv-2504.
S. Elder, N. Zahan, V. Kozarev, R. Shu, T. Menzies, and L. Williams, "Structuring a Comprehensive Software Security Course Around the OWASP Application Security Verification Standard," in 2021 IEEE/ACM 43rd International Conference on Software Engineering: Software Engineering Education and Training (ICSE-SEET), 2021, pp. 95-104.
T. Xiaotian, Z. Xiaosong and C. Ruidong, "Collaborative Agent Framework for Web Vulnerability Discovery in Source Code," 2025 22nd International Computer Conference on Wavelet Active Media Technology and Information Processing (ICCWAMTIP), Chengdu, China, 2025, pp. 1-12, doi: 10.1109/ICCWAMTIP68645.2025.11352622.
X. Liu et al., "DeepSeek-V3: A 671B Parameter Model with Multi-head Latent Attention," arXiv preprint, 2024. Available: https://arxiv.org/abs/2412.19437
CWE, "Common Weakness Enumeration," 2024. [Online]. Available: https://cwe.mitre.org/
Y. Zhou, E. Wang, and S. Ma, "SSRFSeek: An LLM-based Static Analysis Framework for Detecting SSRF Vulnerabilities in PHP Applications," in 2025 IEEE 6th International Seminar on Artificial Intelligence, Networking and Information Technology (AINIT), Chengdu, China, 2025. available: https://ieeexplore.ieee.org/document/11035424
OWASP, "OWASP Juice Shop," 2024. [Online]. Available: https://owasp.org/www-project-juice-shop/
OWASP, "WebGoat," 2024. [Online]. Available: https://owasp.org/www-project-webgoat/
Author's Implementation, "Ultimate PHP Vulnerability Detector," 2026. [Online]. Available: https://github.com/cycyberuk/php-vuln-detector (Accessed: July 2026).
This work is licensed under a Creative Commons Attribution 4.0 International License.
All articles published in our journal are licensed under CC-BY 4.0, which permits authors to retain copyright of their work. This license allows for unrestricted use, sharing, and reproduction of the articles, provided that proper credit is given to the original authors and the source.