.png){kind=icon}
返回
SecureQwen: Leveraging LLMs for vulnerability detection in python codebases
.png){kind=icon}
PRE
AI
DOI：10.1016/j.cose.2024.104151.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Identifying vulnerabilities in software code is crucial for ensuring the security of modern systems. However, manual detection requires expert knowledge and is time-consuming, underscoring the need for automated techniques. In this paper, we present SecureQwen, a novel vulnerability detection tool leveraging large language models (LLMs) with a context length of 64K tokens to identify potential security threats in largescale Python codebases. Utilizing a decoder-only transformer architecture, SecureQwen captures complex relationships between code tokens, enabling accurate classification of vulnerable code sequences across 14 common weakness enumerations (CWEs), including OS Command Injection, SQL Injection, Improper Check or Handling of Exceptional Conditions, Path Traversal, Broken or Risky Cryptographic Algorithm, Deserialization of Untrusted Data, and Cleartext Transmission of Sensitive Information. Therefore, we evaluate SecureQwen on a large Python dataset with over 1.875 million function-level code snippets from different sources, including GitHub repositories, Codeparrot's dataset, and synthetic data generated by GPT4-o. The experimental evaluation demonstrates high accuracy, with F1 scores ranging from 84% to 99%. The results indicate that SecureQwen effectively detects vulnerabilities in human-written and AI-generated code.
Keyword:
Static analysis
Vulnerability detection
Codebase
Large language model
Software security
Security
Generative pre-trained transformers
期刊
C
IF:
5.4
论文数:
4.6K
被引数:
1.4W
机构
引用论文
Managing biodiversity on private land: Directions for collaboration through reconciliation ecology
OAAI
OAAI分享收藏Python source code vulnerability detection with named entity recognition基于命名实体识别的Python源代码漏洞检测.png)
COMPUTERS & SECURITY
COMPUTERS & SECURITYIF5.4
PREAI
分享收藏GRACE: Empowering LLM-based software vulnerability detection with graph structure and in-context learningGRACE: 通过图结构和上下文学习增强基于LLM的软件漏洞检测
PREAI
分享收藏SySeVR: A Framework for Using Deep Learning to Detect Software VulnerabilitiesSySeVR: 使用深度学习检测软件漏洞的框架
OAAI
OAAI分享收藏
查看更多内容