Abstract:Web services play an important role in our daily lives. They are used in a wide range of activities, from online banking and shopping to education, entertainment and social interactions. Therefore, it is essential to ensure that they are kept as secure as possible. However – as is the case with any complex software system – creating a sophisticated software free from any security vulnerabilities is a very challenging task. One method to enhance software security is by employing static code analysis. This technique can be used to identify potential vulnerabilities in the source code before they are exploited by bad actors. This approach has been instrumental in tackling many vulnerabilities, but it is not without limitations. Recent research suggests that static code analysis can benefit from the use of large language models (LLMs). This is a promising line of research, but there are still very few and quite limited studies in the literature on the effectiveness of various LLMs at detecting vulnerabilities in source code. This is the research gap that we aim to address in this work. Our study examined five notable LLM chatbot models: ChatGPT 4, ChatGPT 3.5, Claude, Bard/Gemini 1 , and Llama-2, assessing their abilities to identify 104 known vulnerabilities spanning the Top-10 categories defined by the Open Worldwide Application Security Project (OWASP). Moreover, we evaluated issues related to these LLMs’ false-positive rates using 97 patched code samples. We specifically focused on PHP vulnerabilities, given its prevalence in web applications. We found that ChatGPT-4 has the highest vulnerability detection rate, with over 61.5% of vulnerabilities found, followed by ChatGPT-3.5 at 50%. Bard has the highest rate of vulnerabilities missed, at 53.8%, and the lowest detection rate, at 13.4%. For all models, there is a significant percentage of vulnerabilities that were classified as partially found, indicating a level of uncertainty or incomplete detection across all tested LLMs. Moreover, we found that ChatGPT-4 and ChatGPT-3.5 are consistently more effective across most categories, compared to other models. Bard and Llama-2 display limited effectiveness in detecting vulnerabilities across the majority of categories listed. Surprisingly, our findings reveal high false positive rates across all LLMs. Even the model demonstrating the best performance (ChatGPT-4) notched a false positive rate of nearly 63%, while several models glaringly under-performed, hitting startlingly bad false positive rates of over 90%. Finally, simultaneously deploying multiple LLMs for static analysis resulted in only a marginal enhancement in the rates of vulnerability detection. We believe these results are generalizable to most other programming languages, and hence far from being limited to PHP only.

Code Vulnerability Detection: A Comparative Analysis of Emerging Large Language Models

Understanding the Effectiveness of Large Language Models in Detecting Security Vulnerabilities

Large Language Models for Secure Code Assessment: A Multi-Language Empirical Study

Harnessing Large Language Models for Software Vulnerability Detection: A Comprehensive Benchmarking Study

Software Vulnerability and Functionality Assessment using LLMs

How Far Have We Gone in Vulnerability Detection Using Large Language Models

A Comprehensive Study of the Capabilities of Large Language Models for Vulnerability Detection

Vulnerability Detection in Popular Programming Languages with Language Models

Large Language Model for Vulnerability Detection: Emerging Results and Future Directions

Large Language Models and Code Security: A Systematic Literature Review

Outside the Comfort Zone: Analysing LLM Capabilities in Software Vulnerability Detection

LLbezpeky: Leveraging Large Language Models for Vulnerability Detection

VulDetectBench: Evaluating the Deep Capability of Vulnerability Detection with Large Language Models

ChatNVD: Advancing Cybersecurity Vulnerability Assessment with Large Language Models

An Empirical Evaluation of Large Language Models in Static Code Analysis for PHP Vulnerability Detection

Comparison of Static Application Security Testing Tools and Large Language Models for Repo-level Vulnerability Detection

VulnLLMEval: A Framework for Evaluating Large Language Models in Software Vulnerability Detection and Patching

Towards Effectively Detecting and Explaining Vulnerabilities Using Large Language Models

Multitask-based Evaluation of Open-Source LLM on Software Vulnerability

How secure is AI-generated Code: A Large-Scale Comparison of Large Language Models