Year: 2024
Type: conference-paper
Abstract: The increasing use of generative Artificial Intelligence (AI) in modern software engineering, particularly Large Language Models (LLMs) for code generation, has transformed professional software development by boosting productivity and automating development processes. This adoption, however, has highlighted a significant issue: the introduction of security vulnerabilities into the code. These vulnerabilities result, e.g., from flaws in the training data that propagate into the generated code, creating challenges in tackling them in established ways. Traditional vulnerability handling processes often involve extensive manual review. Applying such traditional processes to AI-generated code is challenging. AI-generated code may include several similar vulnerabilities, possibly in slightly different forms as developers might not build on already implemented code, using functions or libraries, but prompt similar tasks. In this work, we explore the current state of LLM-based approaches for vulnerability handling, focusing on approaches for vulnerability detection, localization, and repair. We provide an overview of recent progress in this area and highlight open challenges that must be addressed to establish a reliable and scalable vulnerability handling process for AI-generated code.
Authors: Sabrina Kaniewski, Dieter Holstein, Fabian Schmidt, Tobias Heer
Institution: Esslingen University of Applied Sciences
Language: English
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
Funder: Deutsche Forschungsgemeinschaft
OpenAlex ID: W4404952844