Breakout Session: AI for Detecting and Fixing Vulnerabilities

​

​

​

Session Chairs: Carlos Rubio-Medrano and Gianluca Stringhini

Relevance

Can Generative Artificial Intelligence (Gen-AI)  models (e.g., Large Language Models) aid the automated identification and assessment of security vulnerabilities?

​

Potential for more secure, safer code everywhere:

​

• Improve efficiency of vulnerability detection and fixes
• Remove the need for in-dept expertise
• Remove costs and effort needed

​

Challenges

• Hardware needed (e.g., GPUs) is costly
• What is the best use of LLMs: bug finders? bug fixers?, bug explainers?,  all-in-one?
• What other approaches are available besides LLMs, i.e., Game Theory?
• How to avoid LLMs from being weaponized?, e.g., identify vulnerable code and create exploits
• Can LLMs introduce more bugs in suggested/implemented patches/solutions?
• How to create a complete lifecycle: detection, exploit, patch generation, and model retrofitting for future secure code generation?
• We need a better understanding of how vulnerability detection/handling is done in industry

Future Directions

• Develop formal definitions and metrics for vulnerabilities
• Funding streams for hardware and API access should be created
• Encourage authors to submit datasets
• Encourage replication/reproduction papers
• Introduce adversarial models, context-aware models, attack-defense methods
• Interact with industry and/or incorporate their tools
• LLMs should play a role as an assistant to traditional program analysis approaches, e.g., agent-based design
• Secure Code Generation is an issue of equal/more importance than vulnerability detection: if LLMs can eventually generate secure code, then vulnerability detection may not be necessary...