Transformer-based Vulnerability Detection in Code at EditTime:
  Zero-shot, Few-shot, or Fine-tuning?
Software vulnerabilities bear enterprises significant costs. Despite
extensive efforts in research and development of software vulnerability
detection methods, uncaught vulnerabilities continue to put software owners and
users at risk. Many current vulnerability detection methods require that code
snippets can compile and build before attempting detection. This,
unfortunately, introduces a long latency between the time a vulnerability is
injected to the time it is removed, which can substantially increases the cost
of fixing a vulnerability. We recognize that the current advances in machine
learning can be used to detect vulnerable code patterns on syntactically
incomplete code snippets as the developer is writing the code at EditTime. In
this paper we present a practical system that leverages deep learning on a
large-scale data set of vulnerable code patterns to learn complex
manifestations of more than 250 vulnerability types and detect vulnerable code
patterns at EditTime. We discuss zero-shot, few-shot, and fine-tuning
approaches on state of the art pre-trained Large Language Models (LLMs). We
show that in comparison with state of the art vulnerability detection models
our approach improves the state of the art by 10%. We also evaluate our
approach to detect vulnerability in auto-generated code by code LLMs.
Evaluation on a benchmark of high-risk code scenarios shows a reduction of up
to 90% vulnerability reduction.
647ea05c11084fb5831e6091
Aaron Chan
647ea05c11084fb5831e6092
Anant Kharkar
647ea05c11084fb5831e6093
Roshanak Zilouchian Moghaddam
647ea05c11084fb5831e6094
Yevhen Mohylevskyy
647ea05c11084fb5831e6095
Alec Helyar
admin_assigned
2023-06-06T09:53:17.489Z
6385710c20e00df40e4e5275
/avatars/bd793f0f456cbb1fca47ce9aca9c2acc.svg
Alec Helyar
user
alech97
647ea05c11084fb5831e6096
Eslam Kamal
647ea05c11084fb5831e6097
Mohamed Elkamhawy
647ea05c11084fb5831e6098
Neel Sundaresan
Transformer-based Vulnerability Detection in Code at EditTime:
  Zero-shot, Few-shot, or Fine-tuning?
Software vulnerabilities bear enterprises significant costs. Despite
extensive efforts in research and development of software vulnerability
detection methods, uncaught vulnerabilities continue to put software owners and
users at risk. Many current vulnerability detection methods require that code
snippets can compile and build before attempting detection. This,
unfortunately, introduces a long latency between the time a vulnerability is
injected to the time it is removed, which can substantially increases the cost
of fixing a vulnerability. We recognize that the current advances in machine
learning can be used to detect vulnerable code patterns on syntactically
incomplete code snippets as the developer is writing the code at EditTime. In
this paper we present a practical system that leverages deep learning on a
large-scale data set of vulnerable code patterns to learn complex
manifestations of more than 250 vulnerability types and detect vulnerable code
patterns at EditTime. We discuss zero-shot, few-shot, and fine-tuning
approaches on state of the art pre-trained Large Language Models (LLMs). We
show that in comparison with state of the art vulnerability detection models
our approach improves the state of the art by 10%. We also evaluate our
approach to detect vulnerability in auto-generated code by code LLMs.
Evaluation on a benchmark of high-risk code scenarios shows a reduction of up
to 90% vulnerability reduction.
A deep learning system using pre-trained Large Language Models improves vulnerability detection by 10% during code editing and reduces up to 90% in auto-generated code scenarios.
deep learning pre-trained Large Language Models zero-shot few-shot fine-tuning vulnerability detection