Using ChatGPT as a Static Application Security Testing Tool

TL;DR

This paper explores the potential of ChatGPT as a tool for static application security testing in Python, comparing its effectiveness to established tools and highlighting its ability to reduce false positives and negatives.

Contribution

It demonstrates the feasibility of using ChatGPT for vulnerability detection in Python code and compares its performance with traditional SAST tools.

Findings

ChatGPT reduces false positive rates.

ChatGPT reduces false negative rates.

Potential for ChatGPT to be used as a security testing tool.

Abstract

In recent years, artificial intelligence has had a conspicuous growth in almost every aspect of life. One of the most applicable areas is security code review, in which a lot of AI-based tools and approaches have been proposed. Recently, ChatGPT has caught a huge amount of attention with its remarkable performance in following instructions and providing a detailed response. Regarding the similarities between natural language and code, in this paper, we study the feasibility of using ChatGPT for vulnerability detection in Python source code. Toward this goal, we feed an appropriate prompt along with vulnerable data to ChatGPT and compare its results on two datasets with the results of three widely used Static Application Security Testing tools (Bandit, Semgrep and SonarQube). We implement different kinds of experiments with ChatGPT and the results indicate that ChatGPT reduces the false positive and false negative rates and has the potential to be used for Python source code vulnerability detection.