Fine-tuning Large Language Models for Software Supply Chains Threats Mitigation

Sammanfattning

The growing complexity and interconnectivity of software supply chains have elevated the risks of security threats, demanding innovative solutions. This thesis investigates the fine-tuning of Large Language Models (LLMs), particularly Microsoft Phi-2, to enhance their ability to identify and mitigate software supply chain vulnerabilities. Using advanced techniques such as Parameter-Efficient Fine-Tuning (PEFT) with Low-Rank Adaptation (LoRA), the Phi-2 model was trained on a domain-specific dataset comprising incident reports, threat intelligence data, and best practices. The methodology encompasses a rigorous evaluation process using quantitative metrics, including ROUGE, BERTScore, and BLEURT, supplemented by qualitative insights derived from semi-structured interviews with cybersecurity experts. The in[1]terviews revealed valuable perspectives on the practical applicability of the fine-tuned model in addressing real-world threats such as compromised third-party components, open-source dependency vulnerabilities, and emerging attack patterns. The fine-tuned model exhibited significant improvements in generating contex[1]tually relevant, precise, and actionable threat mitigation strategies compared to its baseline. The findings demonstrate that domain-specific fine-tuning of LLMs is a vi[1]able approach for advancing automated threat detection and response capabilities in software supply chains. This research provides a robust framework for integrating AI[1]driven solutions into the software development lifecycle, contributing to the fields of software engineering and cybersecurity by improving resilience against supply chain attacks.