In software development, the predominant emphasis on functionality often supersedes security concerns, a trend gaining momentum with AI-driven automation tools like GitHub Copilot. These tools significantly improve developers' efficiency in functional code development. Nevertheless, it remains a notable concern that such tools are also responsible for creating insecure code, predominantly because of pre-training on publicly available repositories with vulnerable code. Moreover, developers are called the "weakest link in the chain" since they have very minimal knowledge of code security. Although existing solutions provide a reasonable solution to vulnerable code, they must adequately describe and educate the developers on code security to ensure that the security issues are not repeated. Therefore we introduce a multipurpose code vulnerability analysis system \texttt{SecRepair}, powered by a large language model, CodeGen2 assisting the developer in identifying and generating fixed code along with a complete description of the vulnerability with a code comment. Our innovative methodology uses a reinforcement learning paradigm to generate code comments augmented by a semantic reward mechanism. Inspired by how humans fix code issues, we propose an instruction-based dataset suitable for vulnerability analysis with LLMs. We further identify zero-day and N-day vulnerabilities in 6 Open Source IoT Operating Systems on GitHub. Our findings underscore that incorporating reinforcement learning coupled with semantic reward augments our model's performance, thereby fortifying its capacity to address code vulnerabilities with improved efficacy.
Vul-R2: A Reasoning LLM for Automated Vulnerability Repair
Tencent Inc.（腾讯公司）；Department of Computer Science, City University of Hong Kong（香港城市大学计算机科学系）；Department of Computer Science and Engineering, The Chinese University of Hong Kong（香港中文大学计算机科学与工程系）
K. N. Toosi University of Technology（肯恩·托基大学）；Ferdowsi University of Mashhad（马什哈德费尔多西大学）；Simon Fraser University（西蒙菲莎大学）；Amirkabir University of Technology（阿米尔卡比尔理工大学）
Nanjing University of Posts and Telecommunications（南京邮电大学）；National Interdisciplinary Research Center of Engineering Physics（工程物理国家 interdisciplinary 研究中心）；Alibaba Qwen（阿里巴巴通义千问）；Beijing Jiaotong University（北京交通大学）；Zhejiang University（浙江大学）；Yangzhou University（扬州大学）；Nanjing University（南京大学）；Singapore Management University（新加坡管理大学）
The Java libraries JCA and JSSE offer cryptographic APIs to facilitate secure coding. When developers misuse some of the APIs, their code becomes vulnerable to cyber-attacks. To eliminate such vulnerabilities, people built tools to detect security-API misuses via pattern matching. However, most tools do not (1) fix misuses or (2) allow users to extend tools' pattern sets. To overcome both limitations, we created Seader-an example-based approach to detect and repair security-API misuses. Given an exemplar <insecure, secure>code pair, Seader compares the snippets to infer any API-misuse template…
Java platform provides various APIs to facilitate secure coding. However, correctly using security APIs is usually challenging for developers who lack cybersecurity training. Prior work shows that many developers misuse security APIs; such misuses can introduce vulnerabilities into software, void security protections, and present security exploits to hackers. To eliminate such API-related vulnerabilities, this paper presents SEADER -- our new approach that detects and repairs security API misuses. Given an exemplar, insecure code snippet, and its secure counterpart, SEADER compares the snippet…
KTH Royal Institute of Technology（瑞典皇家理工学院）；Colorado State University（科罗拉多州立大学）
In this paper, we address the problem of automatic repair of software vulnerabilities with deep learning. The major problem with data-driven vulnerability repair is that the few existing datasets of known confirmed vulnerabilities consist of only a few thousand examples. However, training a deep learning model often requires hundreds of thousands of examples. In this work, we leverage the intuition that the bug fixing task and the vulnerability fixing task are related and that the knowledge learned from bug fixes can be transferred to fixing vulnerabilities. In the machine learning community, …
AutoVulnPHP: LLM-Powered Two-Stage PHP Vulnerability Detection and Automated Localization
Beijing Electronic Science and Technology Institute（北京电子科技学院）；Nankai University（南开大学）；The 15th Research Institute of China Electronics Technology Group Corporation（中国电子科技集团公司第十五研究所）
