[论文解读] Is GitHub's Copilot as Bad as Humans at Introducing Vulnerabilities in Code?

Owura Asare, Meiyappan Nagappan+1 more|arXiv (Cornell University)|Apr 10, 2022

Software Engineering Research被引用 13

一句话总结

本研究通过使用此前在真实C/C++项目中引发漏洞的代码片段作为提示，评估GitHub Copilot引入软件漏洞的频率是否与人类开发者相当。基于Big-Vul数据集，作者发现Copilot仅在33%的情况下重现了有漏洞的代码，仅在25%的情况下生成了修复代码——表明其引入漏洞的倾向不如人类开发者严重，尽管在相当一部分情况下仍会生成不安全的代码。

ABSTRACT

Several advances in deep learning have been successfully applied to the software development process. Of recent interest is the use of neural language models to build tools, such as Copilot, that assist in writing code. In this paper we perform a comparative empirical analysis of Copilot-generated code from a security perspective. The aim of this study is to determine if Copilot is as bad as human developers. We investigate whether Copilot is just as likely to introduce the same software vulnerabilities as human developers. Using a dataset of C/C++ vulnerabilities, we prompt Copilot to generate suggestions in scenarios that led to the introduction of vulnerabilities by human developers. The suggestions are inspected and categorized in a 2-stage process based on whether the original vulnerability or fix is reintroduced. We find that Copilot replicates the original vulnerable code about 33% of the time while replicating the fixed code at a 25% rate. However this behaviour is not consistent: Copilot is more likely to introduce some types of vulnerabilities than others and is also more likely to generate vulnerable code in response to prompts that correspond to older vulnerabilities. Overall, given that in a significant number of cases it did not replicate the vulnerabilities previously introduced by human developers, we conclude that Copilot, despite performing differently across various vulnerability types, is not as bad as human developers at introducing vulnerabilities in code.

研究动机与目标

• 评估GitHub Copilot引入软件漏洞的频率是否与人类开发者相当。
• 将Copilot在生成有漏洞或修复代码方面的行为与Big-Vul数据集中真实世界人类引入的漏洞进行对比。
• 探究Copilot引入漏洞的频率是否因漏洞类型、年龄或修复复杂度而异。
• 评估Copilot行为对安全软件开发及未来AI辅助编程工具的影响。

提出的方法

• 本研究使用Big-Vul数据集，其中包含与有漏洞和修复代码提交相关的实际C/C++漏洞。
• 针对每个漏洞，研究人员提取漏洞引入前的代码片段，并将其作为Copilot的提示。
• 对Copilot生成的建议进行两阶段分类过程：判断输出是否与原始有漏洞代码或修复代码匹配。
• 分析包括对输出进行人工检查和分类，基于其与原始漏洞或修复在安全上的等价性。
• 研究考察Copilot在不同漏洞类型（CWE类别）、发布日期和修复复杂度下的行为差异。
• 使用统计分析方法评估在数据集不同子集中的漏洞重现和修复生成趋势。

实验结果

研究问题

• RQ1 GitHub Copilot与人类开发者相比，是否同样可能在代码中引入相同的漏洞？
• RQ2 Copilot生成有漏洞或修复代码的倾向是否随漏洞年龄而变化？
• RQ3 某些类型的漏洞是否更可能被Copilot重现或修复？
• RQ4 修复的复杂度如何影响Copilot生成正确安全版本的能力？

主要发现

• 在测试的约33%情况下，Copilot重现了原始有漏洞的代码，表明其引入相同漏洞的可能性不如人类开发者高。
• 在25%的情况下，Copilot生成了正确的修复，表明在某些场景下其能够避免已知漏洞。
• Copilot对新近引入的漏洞更少生成有漏洞的代码，显示出在近期安全问题上性能有所提升。
• Copilot在修复较简单的漏洞时表现更佳，表明修复复杂度与生成准确性的相关性。
• Copilot重现漏洞或生成修复的可能性在不同CWE类别间存在显著差异，某些漏洞类型比其他类型更容易被复制。
• 尽管在某些情况下其表现优于人类，Copilot在至少三分之一的评估场景中仍会引入不安全代码，凸显了持续存在的安全风险。