ChatGPT for Vulnerability Detection, Classification, and Repair: How Far Are We?

M. Corporation, “Common weakness enumeration (cwe),” https://cwe.mitre.org/index.html

2006

Earlier work this paper cites.

H. Husain, H.-H. Wu, T. Gazit, M. Allamanis, and M. Brockschmidt, “Codesearchnet challenge: Evaluating the state of semantic code search,” arXiv preprint arXiv:1909.09436 , 2019

Original

2019

Earlier work this paper cites.

T. Brown, B. Mann, N. Ryder, M. Subbiah, J. D. Kaplan, P. Dhariwal, A. Neelakantan, P. Shyam, G. Sastry, A. Askell et al. , “Language models are few-shot learners,” Advances in neural information processing systems , vol. 33, pp. 1877–1901, 2020

2020

Earlier work this paper cites.

J. Fan, Y. Li, S. Wang, and T. N. Nguyen, “A c/c++ code vulnerability dataset with code changes and cve summaries,” in Proceedings of the 17th International Conference on Mining Software Repositories (MSR) , 2020, pp. 508–512

2020

Earlier work this paper cites.

Z. Feng, D. Guo, D. Tang, N. Duan, X. Feng, M. Gong, L. Shou, B. Qin, T. Liu, D. Jiang et al. , “Codebert: A pre-trained model for programming and natural languages,” in Findings of the Association for Computational Linguistics: EMNLP 2020 , 2020, pp. 1536–1547

2020

Earlier work this paper cites.

G. Bhandari, A. Naseer, and L. Moonen, “Cvefixes: automated collection of vulnerabilities and their fixes from open-source software,” in Proceedings of the 17th International Conference on Predictive Models and Data Analytics in Software Engineering , 2021, pp. 30–39

2021

Earlier work this paper cites.

D. Guo, S. Ren, S. Lu, Z. Feng, D. Tang, L. Shujie, L. Zhou, N. Duan, A. Svyatkovskiy, S. Fu et al. , “Graphcodebert: Pre-training code representations with data flow,” in International Conference on Learning Representations , 2021

2021

Earlier work this paper cites.

Z. Chen, S. Kommrusch, and M. Monperrus, “Neural transfer learning for repairing security vulnerabilities in c code,” IEEE Transactions on Software Engineering (TSE) , 2022. [Online]. Available: https://arxiv.org/pdf/2104.08308

Original

2022

Cited alongside, same era.

M. Fu and C. Tantithamthavorn, “Linevul: A transformer-based line-level vulnerability prediction,” in 2022 IEEE/ACM 19th International Conference on Mining Software Repositories (MSR) . IEEE, 2022

2022

Cited alongside, same era.

M. Fu, C. Tantithamthavorn, T. Le, V. Nguyen, and D. Phung, “Vulrepair: a t5-based automated software vulnerability repair,” in Proceedings of the 30th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) , 2022, pp. 935–947

2022

Cited alongside, same era.

OpenAI, “Chatgpt,” https://openai.com/blog/chatgpt, 2022

2022

Cited alongside, same era.

E. A. Napoli and V. Gatteschi, “Evaluating chatgpt for smart contracts vulnerability correction,” in 2023 IEEE 47th Annual Computers, Software, and Applications Conference (COMPSAC) . IEEE, 2023, pp. 1828–1833

2023

Closest in time.

——, “Gpt-4 technical report,” 2023

2023

Closest in time.

H. Pearce, B. Tan, B. Ahmad, R. Karri, and B. Dolan-Gavitt, “Examining zero-shot vulnerability repair with large language models,” in 2023 IEEE Symposium on Security and Privacy (SP) . IEEE, 2023, pp. 2339–2356

2023

Closest in time.

D. Sobania, M. Briesch, C. Hanna, and J. Petke, “An analysis of the automatic bug fixing performance of chatgpt,” arXiv preprint arXiv:2301.08653 , 2023

Original

2023

Closest in time.

J. White, S. Hays, Q. Fu, J. Spencer-Smith, and D. C. Schmidt, “Chatgpt prompt patterns for improving code quality, refactoring, requirements elicitation, and software design,” arXiv preprint arXiv:2303.07839 , 2023