A Survey on Security of Automatic Generated Code

Papers

• Towards Automatic Generation of Vulnerability-Based Signatures

• Exploiting and Protecting Dynamic Code Generation (NDSS’ 15)

• An Empirical Cybersecurity Evaluation of GitHub Copilot’s Code Contributions

  • News: https://www.toolbox.com/tech/security/news/40-of-code-produced-by-github-copilot-vulnerable-to-threats-research/

• Automatic Patch Generation by Learning Correct Code (PLDI’16)

Documentation

• https://docs.microsoft.com/en-us/dotnet/standard/security/security-and-on-the-fly-code-generation

• CWE-94: Improper Control of Generation of Code (‘Code Injection’) https://cwe.mitre.org/data/definitions/94.html

Reinforcement Learning-based Hierarchical Seed Scheduling for Greybox Fuzzing   Automatic Firmware Emulation through Invalidity-guided Knowledge Inference