Intelligent Chatbot

for Secure Code

Analysis
Introducing an innovative chatbot that harnesses the power of Large Language
Models (LLMs) to analyze code for vulnerabilities across 54 programming
languages. This intelligent system provides developers with real-time insights
and recommended fixes to enhance the security of their applications.
Detecting Vulnerabilities in
Code
1 Comprehensive 2 Two-Level Approach
Scanning The system combines an
The chatbot can process code algorithm-based comparison
in 54 of the most popular with pre-existing standard
programming languages, vulnerabilities that are
ensuring wide coverage of commonly occurring, which is
potential vulnerabilities. the traditional way of finding
vulnerabilities and an LLM-
powered analysis for more
advanced detection.

3 High Accuracy
The chatbot's LLM, Deepseek-Coders, is trained to prioritize the
accuracy and efficiency of vulnerability detection.
Supported Programming
Languages
Wide Coverage How it works
The chatbot can accept code in The input language is detected
54 of the most popular by the backend program is by
programming languages, using python module called
ensuring broad applicability "GuessLang".
across various software projects.
It has been been trained with
over a million source code files.

Flexibility Future-Proof
Developers can utilize the As new languages emerge, the
chatbot's services regardless of chatbot's capabilities can be
their preferred language, expanded to keep up with the
streamlining the code analysis evolving technology landscape.
process.
Leveraging Large Language Models
Powerful Capabilities Contextual Awareness Continuous Learning
The chatbot utilizes the impressive LLMs can recognize complex patterns The system can continuously improve its
abilities of Large Language Models to and relationships within code, allowing vulnerability detection by incorporating
understand and analyze code, going for more accurate identification of feedback and updates to the LLM mode
beyond traditional rule-based potential vulnerabilities.
approaches.
Two-Level Vulnerability
Detection
1 Algorithm-Based Scanning
The first layer compares the code against a database of known
vulnerabilities, using pattern-matching algorithms to identify
potential issues, which is the traditional way of finding the
vulnerabilities.

2 LLM-Powered Analysis
The second layer leverages the deep understanding of the
LLM, Deepseek-Coders, to uncover more complex and
contextual vulnerabilities.

3 Comprehensive Approach
By combining these two techniques, the chatbot can provide a
robust and thorough analysis of the code's security posture.
Working of input text
Frontend:

The front end home page provides the user with two options, "Cure Code" which lets you paste your code
and "Cure GitHub Repository" which lets you paste your GitHub repository URL.

The two options lead to two separate web pages

The user input is taken from the front end and its processed in the backend.
The corrected code and the vulnerabilities present in the code is given as the output in the front end in
two boxes separately.

Backend Code for Text:

The given input of code is read by python and it is directly sent to the Snyk platform, which is the traditional method of finding
vulnerabilities. The working of Snyk is explained below;
Open Source Dependencies: Snyk analyzes your project’s dependencies (e.g., npm, Maven, Python, etc.) by checking them
against its extensive vulnerability database. This includes both direct and transitive dependencies.
Codebase: Snyk Code scans proprietary code for vulnerabilities such as security misconfigurations, insecure code patterns, and
known vulnerabilities in libraries.
Infrastructure as Code (IaC): Snyk scans cloud configuration files (e.g., Terraform, Kubernetes, AWS CloudFormation) to detect
security misconfigurations that might lead to security risks.
 The output from Snyk and the input from the user are both taken as the input to the Large Language Models(LLM). This is to ensure
that the output by Snyk is double checked by the LLM and it also provides a coherent output. When output of Snyk and the LLM are
printed separately there are chances that both Snyc and the LLM output the same vulnerabilities, this ensures that the duplication of
elements are deleted.
Then the LLM works on the input, the process is explained below:
1. Understanding the Code
Syntax Parsing: The LLM first parses the input code, understanding its syntax and structure. It recognizes the language being used
(e.g., Python, Java, JavaScript) and identifies key components such as variables, functions, classes, and loops.
Context Analysis: The LLM uses context to understand the purpose of the code, recognizing patterns and common usage scenarios.
It identifies the flow of the code, how data is passed, and how functions interact with each other.
Vulnerability Recognition: Based on its training, the LLM has learned common vulnerabilities like SQL injection, Cross-Site Scripting
(XSS), buffer overflows, insecure deserialization, and others. It matches parts of the code to known vulnerability patterns.

2. Identifying Vulnerabilities

Pattern Matching: LLMs are trained on vast amounts of data, including secure and insecure coding practices. When the LLM
encounters a code snippet, it compares the code against the patterns it has learned for vulnerable code.

3. Proposing Fixes

Providing Secure Alternatives: Based on the vulnerability detected, the LLM suggests secure alternatives. For instance:
If the code is vulnerable to SQL injection, it might suggest using prepared statements or parameterized queries.
For XSS vulnerabilities, it might recommend escaping user input or using security-focused libraries.

Explanation of Fixes: In addition to providing the fix, the LLM often explains why a particular vulnerability exists and how the proposed
correction addresses it. This helps the user understand the rationale behind the change, improving security knowledge over time

4. Refactoring and Optimization

Code Refactoring: Beyond just fixing vulnerabilities, the LLM can also propose code optimizations or refactorings that enhance
security and performance. For example, it might suggest reducing redundant operations or improving memory management to avoid
buffer overflows.

5. Testing and Validation

Test Case Suggestions: The LLM might suggest creating test cases that target the fixed vulnerabilities, ensuring that the code
behaves securely under various inputs.
Continuous Integration: The LLM could also advise on integrating security testing into a continuous integration (CI) pipeline, using
tools like Snyk, OWASP ZAP, or static analysis tools, ensuring future code remains secure.
By these process the LLM provides the cured code and the corrections in the code as the output to the front end.
Backend code for GitHub:
1. User Provides GitHub Repository Link

The user inputs their GitHub repository link into the system. The system uses GitHub's API to access the repository.

2. Cloning the Repository

The system clones or pulls the codebase from the provided GitHub repository.

3. Initial Vulnerability Scan with Snyk

The system sends the code from the repository to Snyk for analysis.
Snyk scans the code for known vulnerabilities (e.g., outdated dependencies, security flaws in libraries).
From this step the process remains the same for both text and the GitHub repository.
Flowchart
Frontend (User Interface) Tech Stack
HTML/CSS: For structure and styling of the web interface.
JavaScript (React.js): For building a responsive and interactive user interface where developers can submit their code.

Backend Tech stack

GuessLang
Snyks
Ollama => DeepSeek-coder Flask
CI/CD (Continuous Integration & Deployment)
GitHub
Flask
Scanning GitHub
Repositories
Repository Input
1 Users can provide the chatbot with a GitHub repository link,
allowing it to scan all the code within the repository.

Comprehensive Scanning
The chatbot will analyze each file in the repository, make a clone
2 of the repositary and clear the clone after executing the
program, identifying potential vulnerabilities across the entire
codebase.

Vulnerability Reports
The chatbot will generate detailed reports highlighting the
3
identified vulnerabilities and provide the corresponding
recommended fixes.
Use Case: Secure Code Analysis Chatbot for
Developers Use Case Scenario
Developer Intelligent Chatbot (backed by an LLM) DevOps/Security Engineer Problem Statement: Developers often introduce
unintentional vulnerabilities in code during the development phase due to time constraints or a lack of security expertise. Traditional
code reviews are time-consuming, and automated scanners may not always provide context-aware feedback. An intelligent chatbot
integrated with an LLM can bridge this gap by providing real-time security analysis and solving all the errors across multiple
programming languagesUser Journey: Actors: Developer: Needs to write secure code and quickly identify vulnerabilities. Chatbot: A
chatbot powered by an LLM that identifies vulnerabilities and suggests fixes.Workflow: Code Submission The developer interacts
with the chatbot through a website and submits a piece of code for reviewIterative Review

The developer submits another version or asks for feedback on additional code snippets. The chatbot continues assisting by analyzing
codeBenefits: Immediate Feedback: Developers receive real-time feedback during development, minimizing security risks early. Multi-
Language Support: The chatbot handles multiple programming languages (Python, Java, JavaScript, etc.) without the need for separate
tools. Context-Aware Fixes: The LLM provides meaningful, actionable suggestions aligned with best practices.

Seamless Integration: Can be integrated into GitHub workflows streamline code reviews.Business Impact: Faster Time-to-Market:
Secure code delivered quickly by reducing the manual code review burden. Reduced Security Risks: Identifying and addressing
vulnerabilities early avoids costly fixes later in production. Improved Developer Productivity: Developers get instant assistance, reducing
dependency on security teams.
Recommended Fixes

Suggested Fixes
Since its local server, the output is provided much faster. But since the device
specs is low, the output takes a lot of time. Setting up an actual server will
make it much more faster and scalable And it will rely on no other servers
since there is no API involved.\

Educational Resources
Along with the fixes, the chatbot offers explanations and educational materials
to help developers understand the nature of the vulnerabilities.

Collaborative Approach
The chatbot encourages developers to engage in a dialogue, allowing for
feedback and iterative improvements to the recommendations.
Conclusion
Hence an intelligent chatbot which is capable of handling inputs from multiple languages, scan all the inputs for vulnerabilities and
security issues and outputs all of the vulnerabilities found which also provides the correct code has been created by using a Large
Language Model(LLM).