Title: SecTest-Eval: Can LLMs Verify Security Impacts of A Vulnerability?
Primary area: datasets and benchmarks
Keywords: Large Language Models (LLMs), Security Impact, CIA Triad, SecTestCase, Vulnerable Functions

Abstract: Large language models (LLMs) have shown remarkable potential in cybersecurity applications, particularly in code vulnerability analysis for both defensive and offensive purposes. Hence, several benchmarks have emerged to evaluate LLMs' capabilities in verifying security impacts of a vulnerability. To achieve this, existing benchmarks challenge models with generating a test program for verifying a given security impact in the context of project-level code. While demonstrating the complexity of real-world scenarios, existing benchmark may lead to underestimate LLMs' comprehension on exploitation methods causing security impacts due to excessive context length and limited covered exploitation methods and security impacts. In this paper, we introduce SecTest-Eval, a benchmark that challenges LLMs to generate a unit test program for verifying security impacts of a vulnerable function. Task instances in SecTest-Eval covering vulnerable C/C++ functions in different lengths, across 14 weakness types and 3 security impacts covering confidentiality, integrity, and availability. Our evaluation of 5 state-of-the-art LLMs shows that LLMs are not yet capable of precisely verifying security impacts through test program generation, with success rates up to 56%, significantly lower than the requirements for practical security applications. The results underscore the need for further advancements in LLMs' vulnerability analysis capabilities.