Negri-Ribalta Claudia, Geraud-Stewart Rémi, Sergeeva Anastasia, Lenzini Gabriele
Security and Trust, University of Luxembourg, Luxembourg, Luxembourg.
École Normale Supérieure, Paris, France.
Front Big Data. 2024 May 13;7:1386720. doi: 10.3389/fdata.2024.1386720. eCollection 2024.
Artificial Intelligence (AI) is increasingly used as a helper to develop computing programs. While it can boost software development and improve coding proficiency, this practice offers no guarantee of security. On the contrary, recent research shows that some AI models produce software with vulnerabilities. This situation leads to the question: How serious and widespread are the security flaws in code generated using AI models?
Through a systematic literature review, this work reviews the state of the art on how AI models impact software security. It systematizes the knowledge about the risks of using AI in coding security-critical software.
It reviews what security flaws of well-known vulnerabilities (e.g., the MITRE CWE Top 25 Most Dangerous Software Weaknesses) are commonly hidden in AI-generated code. It also reviews works that discuss how vulnerabilities in AI-generated code can be exploited to compromise security and lists the attempts to improve the security of such AI-generated code.
Overall, this work provides a comprehensive and systematic overview of the impact of AI in secure coding. This topic has sparked interest and concern within the software security engineering community. It highlights the importance of setting up security measures and processes, such as code verification, and that such practices could be customized for AI-aided code production.
人工智能（AI）越来越多地被用作开发计算程序的辅助工具。虽然它可以促进软件开发并提高编码熟练度，但这种做法并不能保证安全性。相反，最近的研究表明，一些人工智能模型生成的软件存在漏洞。这种情况引发了一个问题：使用人工智能模型生成的代码中的安全漏洞有多严重和普遍？
通过系统的文献综述，这项工作回顾了人工智能模型如何影响软件安全的最新研究状况。它将关于在编写对安全至关重要的软件时使用人工智能的风险的知识进行了系统化整理。
它回顾了著名漏洞（例如，MITRE CWE最危险的25个软件弱点）中哪些安全缺陷通常隐藏在人工智能生成的代码中。它还回顾了讨论如何利用人工智能生成的代码中的漏洞来破坏安全性的相关著作，并列出了为提高此类人工智能生成的代码的安全性所做的尝试。
总体而言，这项工作对人工智能在安全编码中的影响提供了全面而系统的概述。这个话题在软件安全工程领域引发了兴趣和关注。它强调了建立安全措施和流程（如代码验证）的重要性，并且这种做法可以针对人工智能辅助的代码生产进行定制。
