Artificial intelligence has significantly affected various domains recently, notably code-level application security. Vulnerable code snippets can easily propagate across different software platforms, making early detection and correction crucial. Existing machine learning applications often fail to provide comprehensive and accurate results, necessitating time-consuming manual inspections by developers. This paper explores using a fine-tuned large language model (LLM) to detect vulnerabilities in source code. Leveraging the Mistral LLM and LangGraph, the model was trained on a custom dataset to improve performance in identifying and addressing code vulnerabilities. The approach involves fine-tuning models to classify code as vulnerable or non-vulnerable, identifying the Common Weakness Enumeration (CWE) for vulnerable code, and generating secure replacements. The study compares the performance of fine-tuned models with standard LLMs and other detection tools, highlighting the limitations of existing methods. The results demonstrate improved accuracy, reduced false positive and negative rates, and maintained code privacy and security within the local system. This advancement underscores the potential of fine-tuned LLMs and iterative frameworks like LangGraph to improve code security in modern software development.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Leveraging LLM to Detect and Correct Vulnerabilities in Code

  • Ilmaan Zia,
  • Muhammad Abdul Basit Ur Rahim,
  • Ankit Raj,
  • Shahid Hussain

摘要

Artificial intelligence has significantly affected various domains recently, notably code-level application security. Vulnerable code snippets can easily propagate across different software platforms, making early detection and correction crucial. Existing machine learning applications often fail to provide comprehensive and accurate results, necessitating time-consuming manual inspections by developers. This paper explores using a fine-tuned large language model (LLM) to detect vulnerabilities in source code. Leveraging the Mistral LLM and LangGraph, the model was trained on a custom dataset to improve performance in identifying and addressing code vulnerabilities. The approach involves fine-tuning models to classify code as vulnerable or non-vulnerable, identifying the Common Weakness Enumeration (CWE) for vulnerable code, and generating secure replacements. The study compares the performance of fine-tuned models with standard LLMs and other detection tools, highlighting the limitations of existing methods. The results demonstrate improved accuracy, reduced false positive and negative rates, and maintained code privacy and security within the local system. This advancement underscores the potential of fine-tuned LLMs and iterative frameworks like LangGraph to improve code security in modern software development.