GitHub Considered Harmful? Analyzing Open-Source Projects for the Automatic Generation of Cryptographic API Call Sequences

Tony, Catherine; Ferreyra, Nicolás E. Díaz; Scandariato, Riccardo

doi:10.1109/qrs57517.2022.00094

Cited by 3 publications

(5 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Finally, different authors benchmarked in-house AI models and popular models. For example, papers such as Tony et al (2022) with DeepAPI-plusSec and DeepAPI-onlySec and Pearce et al (2023) with Gpt2csrc. Figure 3 shows the LLM instances researched by two or more articles grouped by family.…”

Section: Discussion About Ai Models Comparisons and Methods For Inve...mentioning

confidence: 99%

“…In our sample, four articles (Tony et al, 2022;Jesse et al, 2023;Jha and Reddy, 2023;Wu et al, 2023) analyzed code generation AI models for Java. Each research focused on very different aspects of cyber security and they did not analyze the same vulnerabilities.…”

Section: Javamentioning

confidence: 99%

“…Each research focused on very different aspects of cyber security and they did not analyze the same vulnerabilities. Tony et al (2022) investigated the dangers and incorrect of API calls for cryptographic protocols. Their conclusions is that generative AI might not be at all optimized for generating cryptographically secure code (Tony et al, 2022).…”

Section: Javamentioning

confidence: 99%

“…Tony et al (2022) investigated the dangers and incorrect of API calls for cryptographic protocols. Their conclusions is that generative AI might not be at all optimized for generating cryptographically secure code (Tony et al, 2022). The accuracy of the code generated was significantly lower on cryptographic tasks than what the AI is advertised to have on regular code (Tony et al, 2022).…”

Section: Javamentioning

confidence: 99%

“…Their conclusions is that generative AI might not be at all optimized for generating cryptographically secure code (Tony et al, 2022). The accuracy of the code generated was significantly lower on cryptographic tasks than what the AI is advertised to have on regular code (Tony et al, 2022). Jesse et al (2023) experiments with generating single stupid bugs (SStuB) with different AI models.…”

Section: Javamentioning

confidence: 99%

See 4 more Smart Citations

A systematic literature review on the impact of AI models on the security of code generation

Negri-Ribalta,

Geraud-Stewart,

Sergeeva

et al. 2024

Front. Big Data

View full text Add to dashboard Cite

IntroductionArtificial Intelligence (AI) is increasingly used as a helper to develop computing programs. While it can boost software development and improve coding proficiency, this practice offers no guarantee of security. On the contrary, recent research shows that some AI models produce software with vulnerabilities. This situation leads to the question: How serious and widespread are the security flaws in code generated using AI models?MethodsThrough a systematic literature review, this work reviews the state of the art on how AI models impact software security. It systematizes the knowledge about the risks of using AI in coding security-critical software.ResultsIt reviews what security flaws of well-known vulnerabilities (e.g., the MITRE CWE Top 25 Most Dangerous Software Weaknesses) are commonly hidden in AI-generated code. It also reviews works that discuss how vulnerabilities in AI-generated code can be exploited to compromise security and lists the attempts to improve the security of such AI-generated code.DiscussionOverall, this work provides a comprehensive and systematic overview of the impact of AI in secure coding. This topic has sparked interest and concern within the software security engineering community. It highlights the importance of setting up security measures and processes, such as code verification, and that such practices could be customized for AI-aided code production.

show abstract

Section: Discussion About Ai Models Comparisons and Methods For Inve...mentioning

confidence: 99%

Section: Javamentioning

confidence: 99%