使用 GitHub 增强基于 AI 的代码合成的安全性 通过廉价而高效的即时工程实现副驾驶.docx

EnhancingSecurityofAI-BasedCodeSynthesiswithGitHubCopilotviaCheapandEfficientPrompt-Engineering

JakubRes

iresj@fit.vut.cz

BrnoUniversityofTechnology,FacultyofInformationTechnologyCzechRepublic

Ale?Smr?ka

smrcka@fit.vut.cz

BrnoUniversityofTechnology,FacultyofInformationTechnologyCzechRepublic

ABSTRACT

IvanHomoliak

ihomoliak@fit.vut.czBrnoUniversityofTechnology,

FacultyofInformationTechnologyCzechRepublic

KamilMalinka

malinka@fit.vut.cz

person*newPe

person*newPerson=(person*)malloc(sizeof(person));newPerson-status=0;

MartinPere?íni

iperesini@fit.vut.cz

BrnoUniversityofTechnology,FacultyofInformationTechnologyCzechRepublic

PetrHanacek

hanacek@fit.vut.cz

BrnoUniversityofTechnology,FacultyofInformationTechnologyCzechRepublic

arXiv:2403.12671v1[cs.CR]19Mar2024AIassistantsforcodingareontherise.Howeveroneofthereasonsdevelopersandcompaniesavoidharnessingtheirfullpotentialisthequestionablesecurityofthegeneratedcode.Thispaperfirstreviewsthecurrentstate-of-the-artandidentifiesareasforim-provementonthisissue.Then,weproposeasystematicapproachbasedonprompt-alteringmethodstoachievebettercodesecurityof(evenproprietaryblack-box)AI-basedcodegeneratorssuchasGitHubCopilot,whileminimizingthecomplexityoftheapplica-tionfromtheuserpoint-of-view,thecomputationalresources,andoperationalcosts.Insum,weproposeandevaluatethreepromptalteringmethods:(1)scenario-specific,(2)iterative,and(3)generalclause,whilewediscusstheircombination.Contrarytotheauditofcodesecurity,thelattertwooftheproposedmethodsrequirenoexpertknowledgefromtheuser.WeassesstheeffectivenessoftheproposedmethodsontheGitHubCopilotusingtheOpenVPNprojectinrealisticscenarios,andwedemonstratethat

arXiv:2403.12671v1[cs.CR]19Mar2024

INTRODUCTION

Withtherelea