CWEEP: A Lexical Static Analysis Framework for CWE Early Prevention

2026-07-31

AI Summary

Hardware security verification has long relied on manual inspection and lacks effective methods for automatically identifying security flaws at the register-transfer level (RTL). This work proposes CWEEP—the first static analysis framework capable of detecting security weaknesses in early RTL development without requiring complete security specifications. By integrating lexical analysis, RTL parsing, and vulnerability pattern matching, CWEEP not only precisely localizes potential vulnerabilities but also generates automated repair suggestions. Evaluated on a benchmark dataset comprising 3,874 vulnerable modules, CWEEP achieves a true positive rate of 60.8%, substantially outperforming existing approaches, which attain only 17.5%. These results demonstrate the framework’s effectiveness and technical advancement in early-stage hardware security validation.

Abstract

As the hardware layer becomes a focus point for attackers, the need for improved hardware security verification techniques is more important than ever. State-of-the-art security verification techniques require significant manual effort from individuals with security expertise. Furthermore, there is no standard method to locate where the fault lies within the register transfer level (RTL) code. This paper presents CWEEP, a static analysis framework for detecting security weaknesses in RTL. CWEEP does not require a detailed security specification, so it can be used in the early stages of RTL development while properties are still under construction. Furthermore, CWEEP can identify the exact location in the RTL where the potential vulnerability resides and supports automatic code repair suggestions when applicable. Using datasets from the literature, we evaluate the performance of CWEEP on a set of two SoC designs with manually inserted bugs and on a large language model generated dataset, consisting of 3874 buggy modules. We find that CWEEP issues a correct warning up to 60.8% of the time. In contrast, the tool from a previous work issued a correct warning 17.5% of the time for the same dataset.

Problem

• hardware security
• RTL
• security verification
• vulnerability localization
• static analysis

Innovation

• static analysis
• RTL security
• CWE detection
• automatic repair
• hardware security verification