LLM-Powered Code Vulnerability Repair with Reinforcement Learning and Semantic Reward
Authors:
Nafis Tanveer Islam,
Joseph Khoury,
Andrew Seong,
Mohammad Bahrami Karkevandi,
Gonzalo De La Torre Parra,
Elias Bou-Harb,
Peyman Najafirad
Abstract:
In software development, the predominant emphasis on functionality often supersedes security concerns, a trend gaining momentum with AI-driven automation tools like GitHub Copilot. These tools significantly improve developers' efficiency in functional code development. Nevertheless, it remains a notable concern that such tools are also responsible for creating insecure code, predominantly because…
▽ More
In software development, the predominant emphasis on functionality often supersedes security concerns, a trend gaining momentum with AI-driven automation tools like GitHub Copilot. These tools significantly improve developers' efficiency in functional code development. Nevertheless, it remains a notable concern that such tools are also responsible for creating insecure code, predominantly because of pre-training on publicly available repositories with vulnerable code. Moreover, developers are called the "weakest link in the chain" since they have very minimal knowledge of code security. Although existing solutions provide a reasonable solution to vulnerable code, they must adequately describe and educate the developers on code security to ensure that the security issues are not repeated. Therefore we introduce a multipurpose code vulnerability analysis system \texttt{SecRepair}, powered by a large language model, CodeGen2 assisting the developer in identifying and generating fixed code along with a complete description of the vulnerability with a code comment. Our innovative methodology uses a reinforcement learning paradigm to generate code comments augmented by a semantic reward mechanism. Inspired by how humans fix code issues, we propose an instruction-based dataset suitable for vulnerability analysis with LLMs. We further identify zero-day and N-day vulnerabilities in 6 Open Source IoT Operating Systems on GitHub. Our findings underscore that incorporating reinforcement learning coupled with semantic reward augments our model's performance, thereby fortifying its capacity to address code vulnerabilities with improved efficacy.
△ Less
Submitted 21 February, 2024; v1 submitted 6 January, 2024;
originally announced January 2024.
A New Terrain in HCI: Emotion Recognition Interface using Biometric Data for an Immersive VR Experience
Authors:
Jaehyun Nam,
Hyesun Chung,
Young ah Seong,
Honggu Lee
Abstract:
Emotion recognition technology is crucial in providing a personalized user experience. It is especially important in virtual reality(VR) to assess the user's emotions to enhance their sense of immersion. We propose an emotion recognition interface that incorporates the user's biometric data with machine learning technology for increasing user engagement in VR. Our key technologies include brainwav…
▽ More
Emotion recognition technology is crucial in providing a personalized user experience. It is especially important in virtual reality(VR) to assess the user's emotions to enhance their sense of immersion. We propose an emotion recognition interface that incorporates the user's biometric data with machine learning technology for increasing user engagement in VR. Our key technologies include brainwave sensors and eye-tracking cameras embedded in a VR headset, which seamlessly acquire physiological signals, and secondly, an attractiveness recognition algorithm that uses bio-signals to predict the user's attraction on visual stimuli. We conducted experiments to test the performance of the system, and also interviewed experts and participants to acquire opinions on the system. This study demonstrated the technical feasibility of our system with high accuracy and usability. Interviewees expected that the interface will be actively used in the context of various applications. Our proposed interface could contribute to an immersive VR experience design.
△ Less
Submitted 2 December, 2019;
originally announced December 2019.
