2000 character limit reached
LLM Security Guard for Code (2405.01103v2)
Published 2 May 2024 in cs.SE and cs.CR
Abstract: Many developers rely on LLMs to facilitate software development. Nevertheless, these models have exhibited limited capabilities in the security domain. We introduce LLMSecGuard, a framework to offer enhanced code security through the synergy between static code analyzers and LLMs. LLMSecGuard is open source and aims to equip developers with code solutions that are more secure than the code initially generated by LLMs. This framework also has a benchmarking feature, aimed at providing insights into the evolving security attributes of these models.
- Evaluation of Static Vulnerability Detection Tools With Java Cryptographic API Benchmarks. IEEE Transactions on Software Engineering 49, 2 (2023), 485–497. https://doi.org/10.1109/TSE.2022.3154717
- Is GitHub’s Copilot as bad as humans at introducing vulnerabilities in code? Empirical Software Engineering 28, 6 (23 Sep 2023), 129. https://doi.org/10.1007/s10664-023-10380-1
- Purple Llama CyberSecEval: A Secure Coding Benchmark for Language Models. arXiv preprint arXiv:2312.04724 (2023).
- Noah Bühlmann and Mohammad Ghafari. 2022. How Do Developers Deal with Security Issue Reports on GitHub?. In Proceedings of the 37th ACM/SIGAPP Symposium on Applied Computing (Virtual Event) (SAC ’22).
- Idea: Benchmarking Android Data Leak Detection Tools. In Engineering Secure Software and Systems: 10th International Symposium (Paris, France) (ESSoS ’18). 116–123. https://doi.org/10.1007/978-3-319-94496-8_9
- An Extensive Comparison of Static Application Security Testing Tools. In 28th International Conference on Evaluation and Assessment in Software Engineering (Salerno, Italy) (EASE ’24).
- Large Language Models for Software Engineering: Survey and Open Problems. arXiv:2310.03533
- Security Weaknesses of Copilot Generated Code in GitHub. arXiv preprint arXiv:2310.02059 (2023).
- Security code smells in Android ICC. Empirical Software Engineering 24, 5 (01 Oct 2019), 3046–3076. https://doi.org/10.1007/s10664-018-9673-y
- Security Smells Pervade Mobile App Servers. In Proceedings of the 15th ACM / IEEE International Symposium on Empirical Software Engineering and Measurement (ESEM) (Bari, Italy) (ESEM ’21). https://doi.org/10.1145/3475716.3475780
- Security Smells in Android. In 2017 IEEE 17th International Working Conference on Source Code Analysis and Manipulation (SCAM). 121–130. https://doi.org/10.1109/SCAM.2017.24
- GitHub. 2023. GitHub Copilot for Business is Now Available. https://github.blog/2023-02-14-github-copilot-for-business-is-now-available/ Accessed on January 28, 2024.
- CodeLMSec Benchmark: Systematically Evaluating and Finding Security Vulnerabilities in Black-Box Code Language Models. In 2nd IEEE Conference on Secure and Trustworthy Machine Learning (Toronto, Canada) (SaTML ’24).
- M. Hazhirpasand and M. Ghafari. 2021. Worrisome Patterns in Developers: A Survey in Cryptography. In 2021 36th IEEE/ACM International Conference on Automated Software Engineering Workshops (ASEW). 185–190. https://doi.org/10.1109/ASEW52652.2021.00045
- The Impact of Developer Experience in Using Java Cryptography. In 2019 ACM/IEEE International Symposium on Empirical Software Engineering and Measurement.
- Java Cryptography Uses in the Wild. In Proceedings of the 14th ACM/IEEE International Symposium on Empirical Software Engineering and Measurement (ESEM).
- Large Language Models for Software Engineering: A Systematic Literature Review. arXiv:2308.10620Â [cs.SE]
- A Survey on Hallucination in Large Language Models: Principles, Taxonomy, Challenges, and Open Questions. arXiv:2311.05232Â [cs.CL]
- Meta AI. Year of publication or last update. LLAMA: Language Model for Many Applications. https://ai.meta.com/llama/ Accessed on January 28, 2024.
- An Investigation into Misuse of Java Security APIs by Large Language Models.
- Asleep at the keyboard? assessing the security of github copilot’s code contributions. In 2022 IEEE Symposium on Security and Privacy (SP). IEEE, 754–768.
- Semgrep. Year of the latest commit or release. Semgrep: Lightweight static analysis for many languages. https://github.com/semgrep/semgrep. Accessed on January 28, 2024.
- Security Risks of Porting C Programs to Webassembly. In Proceedings of the 37th ACM/SIGAPP Symposium on Applied Computing (Virtual Event) (SAC ’22). Association for Computing Machinery.
- JIT feedback: what experienced developers like about static analysis. In Proceedings of the 26th Conference on Program Comprehension (Gothenburg, Sweden) (ICPC ’18). 64–73.
- The Effectiveness of Large Language Models (ChatGPT and CodeBERT) for Security-Oriented Code Analysis. (2023). https://doi.org/10.2139/ssrn.4567887
- Weggli-RS. Year of the latest commit or release. Weggli: A Rust implementation of the Wegman-Carter Universal Hashing scheme. https://github.com/weggli-rs/weggli. Accessed on January 28, 2024.
- Insecure by Design in the Backbone of Critical Infrastructure. In Proceedings of Cyber-Physical Systems and Internet of Things Week 2023 (San Antonio, TX, USA) (CPS-IoT Week ’23). Association for Computing Machinery.
- Automatic Detection of Java Cryptographic API Misuses: Are We There Yet? IEEE Transactions on Software Engineering 49, 1 (2023), 288–303.
Sponsor
Paper Prompts
Sign up for free to create and run prompts on this paper using GPT-5.
Top Community Prompts
Collections
Sign up for free to add this paper to one or more collections.