用大模型自动修复容器安全配置错误，准确率达94%
LLMSecConfig: An LLM-Based Approach for Fixing Software Container Misconfigurations
- 结合静态分析与大模型，通过提示工程和检索增强生成修复配置
- 在1000个真实Kubernetes配置上修复成功率94%，新错误极少
- 适合运维与安全工程师，降低手动调优成本
容器编排器中的安全配置错误会严重威胁软件系统。尽管静态分析工具（SATs）能有效检测这些漏洞，但业界仍缺乏自动修复方案。大型语言模型（LLMs）在代码理解与生成方面表现优异，为解决该问题提供了可能。本文提出LLMSecConfig框架，将SATs与LLMs结合，利用高级提示技术和检索增强生成（RAG），在保持功能正常的前提下自动修复安全配置错误。对1000个真实Kubernetes配置的评估显示，修复成功率达到94%，且引入新错误的概率极低。本工作推动了容器安全配置自动化管理的发展，显著减少了配置维护的所需人力。
原文摘要 · Abstract (English)
Security misconfigurations in Container Orchestrators (COs) can pose serious threats to software systems. While Static Analysis Tools (SATs) can effectively detect these security vulnerabilities, the industry currently lacks automated solutions capable of fixing these misconfigurations. The emergence of Large Language Models (LLMs), with their proven capabilities in code understanding and generation, presents an opportunity to address this limitation. This study introduces LLMSecConfig, an innovative framework that bridges this gap by combining SATs with LLMs. Our approach leverages advanced prompting techniques and Retrieval-Augmented Generation (RAG) to automatically repair security misconfigurations while preserving operational functionality. Evaluation of 1,000 real-world Kubernetes configurations achieved a 94\% success rate while maintaining a low rate of introducing new misconfigurations. Our work makes a promising step towards automated container security management, reducing the manual effort required for configuration maintenance.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。