The boom of coding languages in the 1950s revolutionized how our digital world was construed and accessed. The languages invented then, including Fortran, are still in use today due to their versatility and ability to...The boom of coding languages in the 1950s revolutionized how our digital world was construed and accessed. The languages invented then, including Fortran, are still in use today due to their versatility and ability to underpin a large majority of the older portions of our digital world and applications. Fortran, or Formula Translation, was a programming language implemented by IBM that shortened the apparatus of coding and the efficacy of the language syntax. Fortran marked the beginning of a new era of efficient programming by reducing the number of statements needed to operate a machine several-fold. Since then, dozens more languages have come into regular practice and have been increasingly diversified over the years. Some modern languages include Python, Java, JavaScript, C, C++, and PHP. These languages significantly improved efficiency and also have a broad range of uses. Python is mainly used for website/software development, data analysis, task automation, image processing, and graphic design applications. On the other hand, Java is primarily used as a client-side programming language. Expanding the coding languages allowed for increasing accessibility but also opened up applications to pertinent security issues. These security issues have varied by prevalence and language. Previous research has narrowed its focus on individual languages, failing to evaluate the security. This research paper investigates the severity and frequency of coding vulnerabilities comparatively across different languages and contextualizes their uses in a systematic literature review.展开更多
In the modern era of ubiquitous and highly interconnected information technology,cybersecurity threats stemming from software code vulnerabilities have become increasingly severe,posing significant risks to the confid...In the modern era of ubiquitous and highly interconnected information technology,cybersecurity threats stemming from software code vulnerabilities have become increasingly severe,posing significant risks to the confidentiality,integrity,and availability of modern information systems.To enhance software code quality,enterprises often integrate static code analysis tools into Continuous Integration(CI) pipelines.However,the high rates of false positives and false negatives remain a challenge.The advent of large language models(LLMs),such as ChatGPT,presents a new opportunity to address these challenges.In this paper,we propose AI-SCDF,a framework that utilizes the custombuilt Nebula-Coder AI model for detecting and fixing code security issues in real time during the developer ' s personal build process.We construct a static code checking rule knowledge base through summarizing and classifying Common Weakness Enumeration(CWE) code security problems identified by security and quality assurance teams.The rule knowledge base is combined with CodeFuse-processed code contexts to serve as input for an AI code security detection microservice,which assists in identifying code quality and security issues.If any abnormalities are detected,they are addressed by an AI code security patching microservice,which alerts the developer and requests confirmation before committing the code into the repository.Experimental results show that our approach effectively improves code quality.We also develop a VS Code plugin for code alert detection and fix based on LLMs,which facilitates test shift-left and lowers the risk of software development.展开更多
文摘The boom of coding languages in the 1950s revolutionized how our digital world was construed and accessed. The languages invented then, including Fortran, are still in use today due to their versatility and ability to underpin a large majority of the older portions of our digital world and applications. Fortran, or Formula Translation, was a programming language implemented by IBM that shortened the apparatus of coding and the efficacy of the language syntax. Fortran marked the beginning of a new era of efficient programming by reducing the number of statements needed to operate a machine several-fold. Since then, dozens more languages have come into regular practice and have been increasingly diversified over the years. Some modern languages include Python, Java, JavaScript, C, C++, and PHP. These languages significantly improved efficiency and also have a broad range of uses. Python is mainly used for website/software development, data analysis, task automation, image processing, and graphic design applications. On the other hand, Java is primarily used as a client-side programming language. Expanding the coding languages allowed for increasing accessibility but also opened up applications to pertinent security issues. These security issues have varied by prevalence and language. Previous research has narrowed its focus on individual languages, failing to evaluate the security. This research paper investigates the severity and frequency of coding vulnerabilities comparatively across different languages and contextualizes their uses in a systematic literature review.
文摘In the modern era of ubiquitous and highly interconnected information technology,cybersecurity threats stemming from software code vulnerabilities have become increasingly severe,posing significant risks to the confidentiality,integrity,and availability of modern information systems.To enhance software code quality,enterprises often integrate static code analysis tools into Continuous Integration(CI) pipelines.However,the high rates of false positives and false negatives remain a challenge.The advent of large language models(LLMs),such as ChatGPT,presents a new opportunity to address these challenges.In this paper,we propose AI-SCDF,a framework that utilizes the custombuilt Nebula-Coder AI model for detecting and fixing code security issues in real time during the developer ' s personal build process.We construct a static code checking rule knowledge base through summarizing and classifying Common Weakness Enumeration(CWE) code security problems identified by security and quality assurance teams.The rule knowledge base is combined with CodeFuse-processed code contexts to serve as input for an AI code security detection microservice,which assists in identifying code quality and security issues.If any abnormalities are detected,they are addressed by an AI code security patching microservice,which alerts the developer and requests confirmation before committing the code into the repository.Experimental results show that our approach effectively improves code quality.We also develop a VS Code plugin for code alert detection and fix based on LLMs,which facilitates test shift-left and lowers the risk of software development.
