DeVAIC：一种用于AI生成代码安全评估的工具
DeVAIC: A Tool for Security Assessment of AI-generated Code
AI总结：
本文提出DeVAIC工具，通过基于正则表达式的检测规则覆盖35个CWE，实现对AI生成Python代码（包括不完整代码）的安全漏洞检测，F1分数和准确率达94%，平均每个代码片段仅需0.14秒。
摘要：
背景：AI代码生成器正在彻底改变代码编写和软件开发，但它们在大型数据集（包括可能不受信任的源代码）上的训练引发了安全担忧。此外，这些生成器可能产生不完整的代码片段，使用当前解决方案难以评估。目标：本研究工作介绍了DeVAIC（AI生成代码中漏洞的检测），一种用于评估AI生成Python代码安全性的工具，克服了检查不完整代码的挑战。方法：我们遵循了一种方法论方法，包括收集漏洞样本、提取实现模式，并创建正则表达式来开发所提出的工具。DeVAIC的实现包括一组基于正则表达式的检测规则，覆盖了属于OWASP Top 10漏洞类别的35个通用弱点枚举（CWEs）。结果：我们使用四种流行的AI模型生成Python代码，然后将其作为评估我们工具有效性的基础。与最先进的解决方案相比，DeVAIC在检测安全漏洞的能力上表现出统计学显著差异，F1分数和准确率均达到94%，同时保持较低的计算成本，平均每个代码片段0.14秒。结论：所提出的工具即使在处理不完整代码时，也提供了一种轻量级且高效的漏洞检测解决方案。
英文摘要：
Context: AI code generators are revolutionizing code writing and software development, but their training on large datasets, including potentially untrusted source code, raises security concerns. Furthermore, these generators can produce incomplete code snippets that are challenging to evaluate using current solutions. Objective: This research work introduces DeVAIC (Detection of Vulnerabilities in AI-generated Code), a tool to evaluate the security of AI-generated Python code, which overcomes the challenge of examining incomplete code. Method: We followed a methodological approach that involved gathering vulnerable samples, extracting implementation patterns, and creating regular expressions to develop the proposed tool. The implementation of DeVAIC includes a set of detection rules based on regular expressions that cover 35 Common Weakness Enumerations (CWEs) falling under the OWASP Top 10 vulnerability categories. Results: We utilized four popular AI models to generate Python code, which we then used as a foundation to evaluate the effectiveness of our tool. DeVAIC demonstrated a statistically significant difference in its ability to detect security vulnerabilities compared to the state-of-the-art solutions, showing an F1 Score and Accuracy of 94% while maintaining a low computational cost of 0.14 seconds per code snippet, on average. Conclusions: The proposed tool provides a lightweight and efficient solution for vulnerability detection even on incomplete code.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
