SFSCON23 - Jorge Melegati Moritz Mock Barbara Russo - Recommending security fixes for weak open-source code with AI
•
0 likes•16 views
Technical debt is a metaphor that describes not-quite-right code introduced for short-term needs. The effort to refactor it increases if it remains for a long in the software. When developers are aware of it and admit it in source code comments, the debt is called Self-Admitted Technical Debt (SATD). Thus, SATD indicates weak code that developers are aware of. The question is whether they are aware that this code may be vulnerable to attacks. This presentation will illustrate how artificial intelligence can be employed to recommend security fixes for vulnerabilities to developers.
Recommended
Recommended
More Related Content
Similar to SFSCON23 - Jorge Melegati Moritz Mock Barbara Russo - Recommending security fixes for weak open-source code with AI
Similar to SFSCON23 - Jorge Melegati Moritz Mock Barbara Russo - Recommending security fixes for weak open-source code with AI (20)
More from South Tyrol Free Software Conference
More from South Tyrol Free Software Conference (20)
Recently uploaded
Recently uploaded (20)
SFSCON23 - Jorge Melegati Moritz Mock Barbara Russo - Recommending security fixes for weak open-source code with AI
- 1. Recommending security fixes for weak open-source code with AI Moritz Mock Jorge Melegati Barbara Russo 10.11.2023 – 23th SFScon
- 2. Agenda • Problem statement • Background • Existing approach • Generation of a dataset • Proposed solution with CodeBERT 2
- 3. Problem statement • Developers release code that is not perfect • they admit it is not perfect, but they do not know that it could also not be secure 3
- 4. Problem statement • Developers release code that is not perfect • they admit it is not perfect, but they do not know that it could also not be secure 4 • Propose a solution that detects not-perfect code that works, but it is not secure (weak)
- 5. Background • Self-admitted technical debt (SATD) • Vulnerabilities / Common Weakness Enumeration (CWE) • ML for code detection - CodeBERT 5
- 6. Background • Self-admitted technical debt (SATD) • Vulnerabilities / Common Weakness Enumeration (CWE) • ML for code detection - CodeBERT 6
- 8. SATD Self-admitted technical debt Common Weakness Enumeration SATD blocks Weak code WeakSATD heuristic proximity regex srcML SATD patterns 8
- 9. WeakSATD (Russo et al., 2022) • Vulnerabilities from CWE • 34 vulnerability classes • 61 SATD patterns • Potdar and Shihab • Line-level • Leveraging on Chromium 9
- 11. WeakSATD: recommendation 11 • Leveraging CWE recommendation • Easy to understand • Widely accepted by practitioners
- 12. Generation of a dataset 12
- 13. Generation of a dataset • Tangled changes • No dataset annotated for: • SATD comments • Vulnerabilities 13
- 14. Generation of a dataset • Tangled changes • No dataset annotated for: • SATD comments • Vulnerabilities • Function level • Annotation for SATD and Vulnerabilities • Based on Chromium, Mozilla Firefox, and Linux Kernel • Extension from our dataset on Chromium 14
- 15. Process of dataset generation 15
- 18. Proposed solution with CodeBERT 18
- 19. CodeBERT • Pre-trained model on a dataset with over 8 million data points. • Based on the SOTA architecture BERT • CodeBERT has been used in source code related tasks 19
- 20. SATD Self-admitted technical debt Common Weakness Enumeration SATD blocks Weak code WeakSATD heuristic regex srcML SATD patterns Machine Learner w. CodeBERT 20
- 23. CodeBERT: predicted as vulnerable (TP) 23 • CVE-2016-1621 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
- 24. Conclusion • SATD blocks contains vulnerabilities (Russo et. Al 2022) • SATD should be remove fast (Bavota and Russo 2016) • Creating awareness for developers • Creation of a more usable tool for practitioners 24
- 25. Thank you for your attention 25