Software Trustworthiness Assessment via Large Language Models (LLMs)

Nowadays, almost everything in our daily lives is handled by software. From transport systems and autonomous systems to healthcare and financial contracts. So, trustworthiness has become critical. Software trustworthiness refers to the degree to which a software system can be trusted, in the aspects of reliability and security. It means the ability to behave as expected even when facing faults, attacks, or unexpected conditions. Static Code Analysis (SCA) tools can be used to identify security issues, such as software vulnerabilities. Though, SCA tools have a great number of False Positives (FPs) and False Negatives (FNs). Consequently, developers do not use them or spend a lot of time analyzing the alerts reported by such tools without knowing that all vulnerabilities are identified. On the other hand, Large Language Models (LLMs) are being used in software engineering tasks, such as code generation, code review, code documentation, and even bug detection. These capabilities have attracted the interest of researchers to their potential for automating Software Trustworthiness Assessment (STA). As the performance of LLMs in STA is not satiable yet, there is an emerging need to obtain the best results out of their great potential. Although there are many works about the use of LLMs for the Software Vulnerability Detection (SVD), to the best of our knowledge, no other works have evaluated their ability to perform STA. This Ph.D. has 4 goals: 1. To evaluate the ability of LLMs to do the STA, 2. To develop a Software Characterization Mechanism based on LLMs, 3. To develop the Software Compliance and Risk Assessment Process supported by LLMs, and 4. To create an LLM-based tool for STA.