Lecture
Cut Costs. Keep Control: Local LLMs for Secure Code Analysis
- at -
- Hall C6C6.501
- Language: English
- Type: Lecture
Lecture description
"Embedded applications are used in highly constrained and security-critical environments, from secure elements and identity documents to payment, telecom, industrial, and IoT devices. Their development and evaluation require deep knowledge of platform limitations, cryptographic APIs, communication protocols, transaction handling, lifecycle management, and certification expectations. Today, much of this analysis is still performed manually by experienced reviewers. While this approach delivers high-quality results, it is difficult to scale as embedded systems become more connected, updateable, and complex.
This talk presents our practical experience evaluating Large Language Models as an assistant for Java Card and security-critical embedded software analysis. We focus on what LLMs can realistically contribute today: detecting suspicious implementation patterns, explaining platform-specific risks, supporting secure coding reviews, improving documentation, generating test ideas, and helping developers reason about standards-compliant application design.
A key topic is confidentiality. Real Java Card and embedded software projects often include proprietary source code, customer-specific functionality, cryptographic logic, and evaluation evidence that cannot be sent to public cloud-based AI services. We therefore discuss whether small open-source models, deployed locally or in controlled environments, can provide useful results while preserving data confidentiality.
The presentation will share lessons learned, limitations observed, and future opportunities, showing how embedded software teams can combine platform expertise, analysis tools, and confidential AI assistance to address current and future security challenges."
This talk presents our practical experience evaluating Large Language Models as an assistant for Java Card and security-critical embedded software analysis. We focus on what LLMs can realistically contribute today: detecting suspicious implementation patterns, explaining platform-specific risks, supporting secure coding reviews, improving documentation, generating test ideas, and helping developers reason about standards-compliant application design.
A key topic is confidentiality. Real Java Card and embedded software projects often include proprietary source code, customer-specific functionality, cryptographic logic, and evaluation evidence that cannot be sent to public cloud-based AI services. We therefore discuss whether small open-source models, deployed locally or in controlled environments, can provide useful results while preserving data confidentiality.
The presentation will share lessons learned, limitations observed, and future opportunities, showing how embedded software teams can combine platform expertise, analysis tools, and confidential AI assistance to address current and future security challenges."
