PaperlayerView exact revision on arXiv

Source-linked AI summary

ChatGPT for Vulnerability Detection, Classification, and Repair: How Far Are We?

Michael Fu, Chakkrit Tantithamthavorn, Van Nguyen, Trung Le

arXiv:2310.09810v1cs.SEcs.CR

TL;DR

The paper asks how well ChatGPT performs across vulnerability detection, classification, severity estimation, and repair, areas where prior work had not comprehensively evaluated the full workflow. It compares prompted ChatGPT with vulnerability-focused models and finds that ChatGPT fares worse across the tasks.

  • Problem

    Although ChatGPT showed competence in code-related tasks, comprehensive evidence on its performance across the vulnerability workflow was lacking.

    Source: §I · p. 1

  • Method

    The authors evaluate prompted gpt-3.5-turbo and gpt-4 on four vulnerability tasks and compare them with fine-tuned vulnerability models using datasets of over 190,000 C/C++ functions.

    Source: §I · p. 1

  • Results

    Across the four vulnerability tasks, ChatGPT yielded the least favorable outcomes compared with fine-tuned models, including no correct repair patches.

    Source: §I · p. 2, §V · p. 5

  • Takeaways & Limitations

    The findings highlight the need for security expertise and fine-tuning for vulnerability prediction despite large model size.

    Source: (RQ1) How accurate is ChatGPT for… · p. 4

Abstract

from arXiv · show

Large language models (LLMs) like ChatGPT (i.e., gpt-3.5-turbo and gpt-4) exhibited remarkable advancement in a range of software engineering tasks associated with source code such as code review and code generation. In this paper, we undertake a comprehensive study by instructing ChatGPT for four prevalent vulnerability tasks: function and line-level vulnerability prediction, vulnerability classification, severity estimation, and vulnerability repair. We compare ChatGPT with state-of-the-art language models designed for software vulnerability purposes. Through an empirical assessment employing extensive real-world datasets featuring over 190,000 C/C++ functions, we found that ChatGPT achieves limited performance, trailing behind other language models in vulnerability contexts by a significant margin. The experimental outcomes highlight the challenging nature of vulnerability prediction tasks, requiring domain-specific expertise. Despite ChatGPT's substantial model scale, exceeding that of source code-pre-trained language models (e.g., CodeBERT) by a factor of 14,000, the process of fine-tuning remains imperative for ChatGPT to generalize for vulnerability prediction tasks. We publish the studied dataset, experimental prompts for ChatGPT, and experimental results at https://github.com/awsm-research/ChatGPT4Vul.

I. INTRODUCTION

The paper evaluates prompted ChatGPT across four vulnerability tasks against models fine-tuned for software vulnerability work. Across the tasks, ChatGPT trails those baselines, despite its much larger model scale.

I. INTRODUCTION

  • The study addresses the lack of comprehensive evaluation across the vulnerability workflow, from detecting vulnerabilities and explaining types to estimating severity and suggesting repairs.Source: §I · p. 1
  • Because ChatGPT’s parameters are proprietary, the study prompts it rather than fine-tuning it, comparing two ChatGPT versions with vulnerability-focused baselines.Source: §I · p. 1
  • Across the four vulnerability tasks, ChatGPT produced the least favorable outcomes compared with fine-tuned vulnerability models.The evaluation covered over 190,000 C/C++ functions.Source: §I · pp. 1–2
  • ChatGPT’s function and line-level prediction results were lowest among the baselines: F1-measure of 10% and 29%, and top-10 accuracy of 25% and 65%.Source: §I · p. 1
  • For vulnerability classification, ChatGPT achieved 13% and 20% accuracy, 45%-52% below the best baseline.Source: §I · p. 1
  • Reported MSE values were 5.4 and 5.85, compared with 1.8 to 1.86 for other baselines; separately, ChatGPT generated no correct repair patches, while baselines repaired 7%-30% of vulnerable functions.Source: §I · p. 2

II. RELATED WORK

Prior work has examined ChatGPT on selected vulnerability and repair tasks, while this paper introduces four vulnerability task formulations and their prompt designs.

II. RELATED WORK

  • Earlier studies examined ChatGPT vulnerability prediction and classification on 120 samples, prompt design for prediction, smart-contract vulnerability correction, and general bug repair.The cited program-repair evaluation did not include the two most advanced ChatGPT versions.Source: §II · p. 2

III. PROBLEM STATEMENT & PROMPT DESIGN

  • The next section formulates vulnerability prediction, classification, severity estimation, and automated repair, then describes prompts for each task.Source: §III · p. 2

A. Prompt ChatGPT for Software Vulnerability Prediction

The prediction prompts frame function vulnerability detection as binary classification and line-level localization as ranking vulnerable statements.

A. Prompt ChatGPT for Software Vulnerability Prediction

B. Prompt ChatGPT for Software Vulnerability Classification

The prompts frame vulnerability classification as identifying a CWE-ID for a vulnerable function and severity estimation as predicting its CVSS score.

B. Prompt ChatGPT for Software Vulnerability Classification

C. Prompt ChatGPT for Vulnerability Severity Estimation

D. Prompt ChatGPT for Automated Vulnerability Repair

The repair task is framed as generating a patch for an input vulnerable function. Prompts include repair examples because the requested outputs are patches rather than complete repaired programs.

D. Prompt ChatGPT for Automated Vulnerability Repair

IV. EXPERIMENTAL DESIGN AND RESULTS

  • The experimental section introduces datasets, baseline-model settings and hardware, then presents each research question’s approach and results.Source: §IV · p. 3

A. Experimental Datasets

Big-Vul supports vulnerability prediction, classification, and severity estimation, while repair uses preprocessed Big-Vul and CVEFixes data. Baselines were reproduced with their original settings, and ChatGPT was prompted through a paid API.

A. Experimental Datasets

  • Big-Vul contains 188k C/C++ functions from 348 projects, including 3,754 vulnerabilities across 91 types, with a 1:20 vulnerable-to-benign ratio.Each vulnerable function has a CWE-ID and CVSS severity score; the data is split 80%/10%/10% for training, validation, and testing.Source: A. Experimental Datasets · p. 3
  • Repair uses 5.5k vulnerable-function and repair-patch pairs from preprocessed Big-Vul and CVEFixes, split 70%/10%/20% for training, validation, and testing.Source: A. Experimental Datasets · p. 3

B. Parameter Settings and Execution Environment

  • Baseline methods were reproduced with their authors’ parameter settings, and ChatGPT prompting used paid OpenAI API access.Experiments ran on Linux with an AMD Ryzen 9 5950X, 64 GB RAM, and an NVIDIA RTX 3090 GPU.Source: B. Parameter Settings and Execution… · p. 3

C. Experimental Results

On function- and line-level vulnerability prediction, ChatGPT trails fine-tuned baselines, including on the reported F1-measure and top-10 accuracy results. The findings point to a need for domain-specific knowledge and fine-tuning.

(RQ1) How accurate is ChatGPT for function and line-level vulnerability predictions?

  • AIBugHunter achieves 94% F1-measure and 99% top-10 accuracy, versus gpt-4’s 29% and 65%; ChatGPT reports 10% F1-measure and 25% top-10 accuracy.Source: (RQ1) How accurate is ChatGPT for… · p. 3, Figure 5 · p. 4
  • Function-level performance is evaluated with F1-measure, precision, and recall; line-level performance uses top-10 accuracy.Top-10 accuracy measures the share of vulnerable functions with at least one actual vulnerable line in the model’s top-10 ranking.Source: (RQ1) How accurate is ChatGPT for… · p. 3
  • The results indicate that vulnerability prediction requires learning domain-specific knowledge, such as vulnerability patterns, and that fine-tuning remains necessary despite large model size.Source: (RQ1) How accurate is ChatGPT for… · p. 4

(RQ2) How accurate is ChatGPT for vulnerability types classification?

ChatGPT’s CWE-ID classification accuracy is limited compared with fine-tuned language-model baselines. The authors attribute the gap to the need to learn mappings from vulnerability patterns to CWE-IDs.

(RQ2) How accurate is ChatGPT for vulnerability types classification?

(RQ3) How accurate is ChatGPT for vulnerability severity estimation?

ChatGPT performed poorly on severity estimation and automated vulnerability repair relative to fine-tuned baselines. Repair was especially difficult: ChatGPT generated no correct patches, while baselines repaired some vulnerable functions.

(RQ3) How accurate is ChatGPT for vulnerability severity estimation?

  • ChatGPT’s CVSS estimation yielded MSE 5.4 and MAE 1.84; gpt-3.5-turbo and gpt-4 had MSE 5.4 and 5.85, versus 1.8–1.86 for fine-tuned baselines.The authors report that accurate severity estimation demands software security expertise that ChatGPT had not acquired during pretraining.Source: (RQ3) How accurate is ChatGPT for… · p. 4

(RQ4) How accurate is ChatGPT for automated vulnerability repair?

V. CONCLUSION

The study evaluates prompted ChatGPT on four vulnerability tasks using over 190,000 real-world C/C++ functions. ChatGPT had the least favorable outcomes across tasks, and the authors conclude that additional fine-tuning is needed for effective generalization.

V. CONCLUSION

  • Across four vulnerability tasks and over 190,000 real-world C/C++ functions, ChatGPT had the least favorable outcomes, particularly struggling to generate accurate repair patches.The evaluated tasks were locating vulnerabilities, identifying vulnerability types, estimating severity scores, and suggesting repair patches.Source: §V · p. 5
  • The authors conclude that vulnerability prediction tasks require security expertise that ChatGPT did not acquire during extensive pretraining.Source: §V · p. 5
  • The authors identify an additional fine-tuning round as pivotal for ChatGPT to generalize effectively to software vulnerability tasks.Source: §V · p. 5
Loading 2310.09810v1…