Using ChatGPT as a Static Application Security Testing Tool

被引：2
|
作者：
Bakhshandeh, Atieh [1 ]
Keramatfar, Abdalsamad [1 ]
Norouzi, Amir [1 ]
Chekidehkhoun, Mohammad M. [1 ]
机构：
[1] Res Ctr Dev Adv Technol, Tehran, Iran
来源：
ISECURE-ISC INTERNATIONAL JOURNAL OF INFORMATION SECURITY | 2023年 / 15卷 / 03期
关键词：
Artificial Intelligence-based Code Review; ChatGPT Model; Common Weakness Enumeration; Static Application Security Testing; Vulnerability Detection;
D O I：
10.22042/isecure.2023.182082
中图分类号：
TP [自动化技术、计算机技术];
学科分类号：
0812 ;
摘要：
In recent years, artificial intelligence has had a conspicuous growth in almost every aspect of life. One of the most applicable areas is security code review, in which a lot of AI-based tools and approaches have been proposed. Recently, ChatGPT has caught a huge amount of attention with its remarkable performance in following instructions and providing a detailed response. Regarding the similarities between natural language and code, in this paper, we study the feasibility of using ChatGPT for vulnerability detection in Python source code. Toward this goal, we feed an appropriate prompt along with vulnerable data to ChatGPT and compare its results on two datasets with the results of three widely used Static Application Security Testing tools (Bandit, Semgrep, and SonarQube). We implement different kinds of experiments with ChatGPT and the results indicate that ChatGPT reduces the false positive and false negative rates and has the potential to be used for Python source code vulnerability detection. (c) 2023 ISC. All rights reserved.
引用
收藏
页码：51 / 58
页数：8
相关论文
共 50 条
  • [31] Blending Static and Dynamic Analysis for Web Application Vulnerability Detection: Methodology and Case Study
    Nunes, Paulo
    Fonseca, Jose
    Vieira, Marco
    IEEE ACCESS, 2025, 13 : 3139 - 3153
  • [32] Finding Taint-Style Vulnerabilities in Lua Application of IoT Firmware with Progressive Static Analysis
    Li, Xixing
    Wei, Qiang
    Wu, Zehui
    Guo, Wei
    APPLIED SCIENCES-BASEL, 2023, 13 (17):
  • [33] HeVulD: A Static Vulnerability Detection Method Using Heterogeneous Graph Code Representation
    Huang, Yuanming
    He, Mingshu
    Wang, Xiaojuan
    Zhang, Jie
    IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, 2024, 19 : 9129 - 9144
  • [34] State of the Art: Automated Black-Box Web Application Vulnerability Testing
    Bau, Jason
    Bursztein, Elie
    Gupta, Divij
    Mitchell, John
    2010 IEEE SYMPOSIUM ON SECURITY AND PRIVACY, 2010, : 332 - 345
  • [35] A New Approach to Web Application Security: Utilizing GPT Language Models for Source Code Inspection
    Szabo, Zoltan
    Bilicki, Vilmos
    FUTURE INTERNET, 2023, 15 (10)
  • [36] A Hybrid Vulnerability Analysis Tool Using a Risk Evaluation Technique
    Park, Jaepyo
    Choo, Yeunsoo
    Lee, Jonghee
    WIRELESS PERSONAL COMMUNICATIONS, 2019, 105 (02) : 443 - 459
  • [37] A Hybrid Vulnerability Analysis Tool Using a Risk Evaluation Technique
    Jaepyo Park
    Yeunsoo Choo
    Jonghee Lee
    Wireless Personal Communications, 2019, 105 : 443 - 459
  • [38] Mutation Based SQL Injection Test Cases Generation for the Web Based Application Vulnerability Testing
    Ilies, Benikhlef
    Wang Chenghong
    Sangirov, Gulomjon
    Proceedings of the 2nd International Conference on Electronics, Network and Computer Engineering (ICENCE 2016), 2016, 67 : 546 - 551
  • [39] Enhancing Java']Java Web Application Security: Injection Vulnerability Detection via Interprocedural Analysis and Deep Learning
    Zhang, Bing
    Zhi, Xu
    Wang, Meng
    Ren, Rong
    Dong, Jun
    IEEE TRANSACTIONS ON RELIABILITY, 2025,
  • [40] Understanding the Security Risks of Websites Using Cloud Storage for Direct User File Uploads
    Chen, Yuanchao
    Li, Yuwei
    Lu, Yuliang
    Pan, Zulie
    Chen, Yuan
    Ji, Shouling
    Chen, Yu
    Li, Yang
    Shen, Yi
    IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, 2025, 20 : 2677 - 2692
12345