These labels were automatically added by AI and may be inaccurate. For details, see About Literature Database.
Abstract
Large Language Models (LLMs) are increasingly used in software development to
generate functions, such as attack detectors, that implement security
requirements. A key challenge is ensuring the LLMs have enough knowledge to
address specific security requirements, such as information about existing
attacks. For this, we propose an approach integrating Retrieval Augmented
Generation (RAG) and Self-Ranking into the LLM pipeline. RAG enhances the
robustness of the output by incorporating external knowledge sources, while the
Self-Ranking technique, inspired by the concept of Self-Consistency, generates
multiple reasoning paths and creates ranks to select the most robust detector.
Our extensive empirical study targets code generated by LLMs to detect two
prevalent injection attacks in web security: Cross-Site Scripting (XSS) and SQL
injection (SQLi). Results show a significant improvement in detection
performance while employing RAG and Self-Ranking, with an increase of up to
71%pt (on average 37%pt) and up to 43%pt (on average 6%pt) in the F2-Score for
XSS and SQLi detection, respectively.
External Datasets
Malicious and Benign payloads of HTTP requests from the FMereani repository