用大模型解释代码漏洞，让开发者秒懂安全问题
Explaining Software Vulnerabilities with Large Language Models
- 用GPT-4o生成漏洞成因、影响和修复建议
- 新手到中级开发者理解漏洞效率提升明显
- 集成在IDE中，直接解决SAST工具解释力弱的问题
安全漏洞频发促使企业采用静态应用安全测试（SAST）工具进行检测。然而，这些工具常因警告信息过于通用，难以向开发者有效传达关键信息，导致误解或忽略重要发现。得益于大语言模型（LLM）近期在文本生成方面的发展，本文提出SAFE——一个集成于IDE的插件，利用GPT-4o为SAST工具检测到的漏洞提供成因、影响及缓解策略的解释。专家用户研究表明，SAFE生成的解释显著帮助初至中级开发者理解并处理安全漏洞，从而提升SAST工具的整体可用性。
原文摘要 · Abstract (English)
The prevalence of security vulnerabilities has prompted companies to adopt static application security testing (SAST) tools for vulnerability detection. Nevertheless, these tools frequently exhibit usability limitations, as their generic warning messages do not sufficiently communicate important information to developers, resulting in misunderstandings or oversight of critical findings. In light of recent developments in Large Language Models (LLMs) and their text generation capabilities, our work investigates a hybrid approach that uses LLMs to tackle the SAST explainability challenges. In this paper, we present SAFE, an Integrated Development Environment (IDE) plugin that leverages GPT-4o to explain the causes, impacts, and mitigation strategies of vulnerabilities detected by SAST tools. Our expert user study findings indicate that the explanations generated by SAFE can significantly assist beginner to intermediate developers in understanding and addressing security vulnerabilities, thereby improving the overall usability of SAST tools.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。