CyberKareemContact Abdullah
Menu

Project case study · reviewed source

kameHunt

An LLM-assisted variant-analysis engine that validates and ranks static-analysis matches into a short list of manually-verifiable leads.

Open reviewed source opens in a new tabRead the engineering article
Role
Designer and developer
Runtime
Python
License
MIT
Reviewed revision
6a6eac1123a0

Problem to outcome · 01

How the problem shaped the design and implementation.

01

Challenge

A narrow signature can miss variants, while a broad static rule can flood the researcher with false positives. The useful result is a short, traceable lead list that still requires manual validation.

02

Design decision

Separate broad detection from validation. Semgrep gathers candidates, provenance-aware heuristics remove obvious noise, an optional LLM pass helps rank the remainder, and the researcher makes every security decision.

03

Contribution

Designed and built the detection, heuristic validation, optional LLM triage, benchmark, CI-tested workflow, and kameReport-compatible export path.

04

Outcome

In a documented seven-case experiment, the broader rule surfaced six candidate patterns instead of none. Each output remains an unverified lead.

Implementation trace · 02

The implementation follows four reviewable stages.

  1. Model the bug

    Translate a known weakness into a deliberately broad source signature.

  2. Collect candidates

    Use Semgrep to find code that may share the relevant data-flow shape.

  3. Reduce noise

    Apply provenance-aware heuristics and optional LLM ranking.

  4. Validate manually

    Review the short list and confirm behavior outside the tool.

Proof and boundaries · 03

Verified behavior and known limits.

Verified in the reviewed source

What the project demonstrates

  • The reviewed repository has a CI-run test suite.
  • A false-positive-reduction benchmark is included.
  • In a documented seven-case experiment, the broader rule surfaced six candidate patterns instead of none.
Operating boundary

What the project does not claim

  • Every result is an unverified research lead.
  • The tool reads code and carries no exploitation or disclosure capability.
  • Optional LLM output cannot replace source review, reproduction, or coordinated disclosure judgment.

CyberKareem/kameHuntThis page references commit 6a6eac1123a02d150945878a798c47e8af752963. The repository may move after that point; the pinned revision keeps this review reproducible.

Inspect pinned revision opens in a new tab

Continue through the portfolio

Open the source, read the method, or compare the wider project set.

The case study separates demonstrated behavior from maturity and operating limits. The repository remains the source of truth.

Browse all projects View professional background