Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

DeVAIC: A Tool for Security Assessment of AI-generated Code

Domenico Cotroneo, Roberta De Luca, Pietro Liguori

TL;DR

DeVAIC (Detection of Vulnerabilities in AI-generated Code), a tool to evaluate the security of AI-generated Python code, which overcomes the challenge of examining incomplete code and provides a lightweight and efficient solution for vulnerability detection even on incomplete code.

Abstract

Context: AI code generators are revolutionizing code writing and software development, but their training on large datasets, including potentially untrusted source code, raises security concerns. Furthermore, these generators can produce incomplete code snippets that are challenging to evaluate using current solutions. Objective: This research work introduces DeVAIC (Detection of Vulnerabilities in AI-generated Code), a tool to evaluate the security of AI-generated Python code, which overcomes the challenge of examining incomplete code. Method: We followed a methodological approach that involved gathering vulnerable samples, extracting implementation patterns, and creating regular expressions to develop the proposed tool. The implementation of DeVAIC includes a set of detection rules based on regular expressions that cover 35 Common Weakness Enumerations (CWEs) falling under the OWASP Top 10 vulnerability categories. Results: We utilized four popular AI models to generate Python code, which we then used as a foundation to evaluate the effectiveness of our tool. DeVAIC demonstrated a statistically significant difference in its ability to detect security vulnerabilities compared to the state-of-the-art solutions, showing an F1 Score and Accuracy of 94% while maintaining a low computational cost of 0.14 seconds per code snippet, on average. Conclusions: The proposed tool provides a lightweight and efficient solution for vulnerability detection even on incomplete code.

DeVAIC: A Tool for Security Assessment of AI-generated Code

TL;DR

DeVAIC (Detection of Vulnerabilities in AI-generated Code), a tool to evaluate the security of AI-generated Python code, which overcomes the challenge of examining incomplete code and provides a lightweight and efficient solution for vulnerability detection even on incomplete code.

Abstract

Context: AI code generators are revolutionizing code writing and software development, but their training on large datasets, including potentially untrusted source code, raises security concerns. Furthermore, these generators can produce incomplete code snippets that are challenging to evaluate using current solutions. Objective: This research work introduces DeVAIC (Detection of Vulnerabilities in AI-generated Code), a tool to evaluate the security of AI-generated Python code, which overcomes the challenge of examining incomplete code. Method: We followed a methodological approach that involved gathering vulnerable samples, extracting implementation patterns, and creating regular expressions to develop the proposed tool. The implementation of DeVAIC includes a set of detection rules based on regular expressions that cover 35 Common Weakness Enumerations (CWEs) falling under the OWASP Top 10 vulnerability categories. Results: We utilized four popular AI models to generate Python code, which we then used as a foundation to evaluate the effectiveness of our tool. DeVAIC demonstrated a statistically significant difference in its ability to detect security vulnerabilities compared to the state-of-the-art solutions, showing an F1 Score and Accuracy of 94% while maintaining a low computational cost of 0.14 seconds per code snippet, on average. Conclusions: The proposed tool provides a lightweight and efficient solution for vulnerability detection even on incomplete code.
Paper Structure (14 sections, 6 figures, 6 tables)

This paper contains 14 sections, 6 figures, 6 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Motivating Example
  4. DeVAIC Workflow
  5. Vulnerable Code Collection
  6. Detection Rules Implementation
  7. Tool Execution
  8. Experimental Evaluation
  9. NL Prompts Details
  10. Manual Analysis
  11. Experimental Results
  12. Computational Cost
  13. Threats to Validity
  14. Conclusion

Figures (6)

  • Figure 1: The DeVAIC workflow.
  • Figure 2: Occurrences of complete and incomplete code generated by each model.
  • Figure 3: Analysis of snippet lengths variability for each classification. The median values are in orange, while the mean values are in green.
  • Figure 4: Comparison of median execution times for DeVAIC, Bandit, CodeQL, Semgrep, and PyT for the analysis of all the $500$ codes generated by the $4$ models.
  • Figure 5: Occurrences of execution times taken by DeVAIC for scanning and evaluating individual code snippets generated by the 4 models.
  • ...and 1 more figures