TY - GEN
T1 - Demo
T2 - 31st ACM SIGSAC Conference on Computer and Communications Security, CCS 2024
AU - Ton, Khiem
AU - Nguyen, Nhi
AU - Nazzal, Mahmoud
AU - Khreishah, Abdallah
AU - Borcea, Cristian
AU - Phan, Hai
AU - Jin, Ruoming
AU - Khalil, Issa
AU - Shen, Yelong
N1 - Publisher Copyright:
© 2024 Copyright held by the owner/author(s).
PY - 2024/12/9
Y1 - 2024/12/9
N2 - This paper introduces SGCode, a flexible prompt-optimizing system to generate secure code with large language models (LLMs). SGCode integrates recent prompt-optimization approaches with LLMs in a unified system accessible through front-end and back-end APIs, enabling users to 1) generate secure code, which is free of vulnerabilities, 2) review and share security analysis, and 3) easily switch from one prompt optimization approach to another, while providing insights on model and system performance. We populated SGCode on an AWS server with PromSec, an approach that optimizes prompts by combining an LLM and security tools with a lightweight generative adversarial graph neural network to detect and fix security vulnerabilities in the generated code. Extensive experiments show that SGCode is practical as a public tool to gain insights into the trade-offs between model utility, secure code generation, and system cost. SGCode has only a marginal cost compared with prompting LLMs. SGCode is available at: SGCode.
AB - This paper introduces SGCode, a flexible prompt-optimizing system to generate secure code with large language models (LLMs). SGCode integrates recent prompt-optimization approaches with LLMs in a unified system accessible through front-end and back-end APIs, enabling users to 1) generate secure code, which is free of vulnerabilities, 2) review and share security analysis, and 3) easily switch from one prompt optimization approach to another, while providing insights on model and system performance. We populated SGCode on an AWS server with PromSec, an approach that optimizes prompts by combining an LLM and security tools with a lightweight generative adversarial graph neural network to detect and fix security vulnerabilities in the generated code. Extensive experiments show that SGCode is practical as a public tool to gain insights into the trade-offs between model utility, secure code generation, and system cost. SGCode has only a marginal cost compared with prompting LLMs. SGCode is available at: SGCode.
KW - Demonstration system
KW - LLMs
KW - Prompt optimization
KW - Secure code
UR - http://www.scopus.com/inward/record.url?scp=85215510203&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85215510203&partnerID=8YFLogxK
U2 - 10.1145/3658644.3691367
DO - 10.1145/3658644.3691367
M3 - Conference contribution
AN - SCOPUS:85215510203
T3 - CCS 2024 - Proceedings of the 2024 ACM SIGSAC Conference on Computer and Communications Security
SP - 5078
EP - 5080
BT - CCS 2024 - Proceedings of the 2024 ACM SIGSAC Conference on Computer and Communications Security
PB - Association for Computing Machinery, Inc
Y2 - 14 October 2024 through 18 October 2024
ER -