2160results about "Reverse engineering" patented technology

Methods, apparatuses, and products for providing a code analysis feedback loop for code created using generative AI, including: performing a code analysis on code generated by a generative AI model; determining, based on the code analysis, whether the code satisfies one or more conditions; responsive to the code failing to satisfy the one or more conditions, until the code satisfies the one or more conditions, repeatedly updating the code by receiving, from the generative AI model, updated code based on a previously performed code analysis; and providing the code generated by the generative AI model.

An example operation may include one or more of receiving a plurality of architecture documents of a plurality of different domains of a software architecture, identifying a missing component that is missing from within the software architecture between a first domain and a second domain among the plurality of domains based on execution of a generative artificial intelligence (GenAI) model based on the plurality of architecture documents of the software architecture, generating a recommended modification to the software architecture based on the identified missing component, and displaying the recommended modification via a user interface.

An example operation may include one or more of training a generative artificial intelligence (GenAI) model based on execution of the GenAI model on software libraries and descriptions of intent of the software libraries, receiving a first set of software libraries and a second set of software libraries, identifying a first software library within the first set of software libraries that includes redundant functionality with a second software library within the second set of software libraries based on execution of a generative artificial intelligence (GenAI) model on the first and second sets of libraries, and displaying an identifier of the first and second software libraries via a user interface.

Some embodiments engineer a prompt for submission to a language model, such as a software development large language model. Some embodiments ascertain a relationship between code development information and potential context. Code development information includes static analysis results, project settings, development tool history or status data, and other software development data which augments training data previously embedded in the language model. Some embodiments compute a prompt inclusion score of the potential context, based on at least the relationship, and use the inclusion score to determine whether to include the potential context in the language model prompt. In some scenarios, an embodiment determines where to place the context in the prompt. Scoring is performed by a formula, statistical scoring model, or machine learning scoring model. Some embodiments reduce context inclusion false positives and false negatives that were based on the use of embedding similarity scores alone.

The present disclosure provides systems and methods that support identification of vulnerabilities within a dataset, such as an unknown binary, using customizable pipelines and workflows. The pipelines may be configured to apply various analysis techniques, including reverse engineering, machine learning / artificial intelligence, and other techniques to elicit various types of data and information from the unknown binary. The pipeline may include stages configured to analyze outputs of prior stages of the pipeline detect whether vulnerabilities or malicious code are present. Different stages of the pipeline may also be configured to initiate additional workflows for further analysis of the binary or intermediate representations of the binary output by prior stages of the pipeline. Additionally, the disclosed systems and methods provide functionality that enables generation of a reverse software bill of materials (SBOM) from an unknown binary or confirmation of contents of an existing SBOM.

An issue source scanning system scans a source of information about an issue to identify characteristics of code which indicate that the issue will manifest in code. A code scanning system scans code to match the identified characteristics against the code to determine whether the source code includes the identified characteristics. The code scanning system automatically generates a suggested operation to perform based upon a match between the identified characteristic and the code.

Disclosed herein are computer-implemented systems and methods for code value assessment. For example, in one aspect, the system comprises, an input module configured to receive program code submissions from developers, a processing unit equipped with Text-Based Models with Contextual Understanding (TBM-CUs) configured to evaluate the functional meaning, purpose, and value of submitted code segments and distinguish between code contributions from human programmers and machine learning systems, a visualization module configured to present the assessed value of the analyzed code over various time periods and dimensions, offering insights into trends, patterns, and comparative performance, a communication module configured to translate programming code meaning or function into plain language summaries for non-technical stakeholders, and an AI peer review module configured to automatically review, accept or reject code contributions.

Techniques and systems described herein relate to monitoring executions of computer instructions on computing devices based on learning and generating a control flow directed graph. The techniques and systems include determining a learned control flow directed graph for executable code of an application by observing executions of transitions during an observation period and determining destinations of indirect transfers based on the learned control flow directed graph. Next a disassembly of the executable code is determined based on the learned control flow directed graph, the destinations of the transfers, and the executable code.

Systems and methods described herein relate to automated troubleshooting for application development tools. First data comprise a plurality of delta objects and a user query. The plurality of delta objects identify design-time changes made to an application using a development tool. The user query is received via a user interface and relates to at least one of the design-time changes. The first data is preprocessed to obtain second data. The preprocessing of the first data includes modifying a subset of the first data and adding one or more predetermined instructions to the first data. The second data is provided to a machine learning model to obtain a response to the user query. Output indicative of the response is caused to be presented in the user interface.

The description relates to automated binary code summarization. In one example, a binary code summarization tool receives binary code and combines the received binary code with natural language in a prompt for a large language model (LLM). The binary code summarization tool receives a semantic summarization from the LLM relating to the received binary code and evaluates the new semantic summarization for malicious functionality in the received binary code.

A method includes generating a modeling language diagram that is indicative of a compiled version of program code. The modeling language diagram includes at least one node corresponding to at least one function in the program code. The method also includes identifying at least one function signature associated with anode state transition between nodes in the modeling language diagram. The method also includes identifying, using a large language model, a particular policy to attribute to the at least one function signature associated with the node state transition. The method further includes performing, using the large language model, a policy compliance operation that ensures a particular portion of the program code complies with the particular policy. The particular portion of the program code is associated with the node state transition. Performing the policy compliance operation includes generating a policy-compliant version of the particular portion of the program code.

The invention discloses an operator migration method and device between hardware platforms and a migration model construction method. The migration method comprises the following steps: obtaining an operator code and a function label of an operator to be migrated; when the existing operator information of the target hardware platform does not contain the function label, obtaining first information of the target hardware platform and second information of the source hardware platform; training a large language model based on the first information and the second information, and taking the trained large language model as an operator automatic migration development model; generating an initial operator matched with the precision requirement of the target hardware platform based on the operator automatic migration development model and the operator code; analyzing the initial operator to obtain an operator precision difference; taking an initial operator corresponding to the operator precision difference passing verification as a target operator; and storing the target operator to a corresponding level of the target hardware platform. According to the method, automatic non-inductive migration of the model operator on different hardware platforms can be realized, and efficient and seamless adaptation with different platforms is realized.

The invention relates to the technical field of vulnerability detection, and provides a fine-grained vulnerability detection method and system based on semantic perception sparse attention, and the method comprises the steps: analyzing a to-be-detected source code, and generating an abstract syntax tree, a control flow graph and a program dependency graph; carrying out weighted fusion on graph representations of the abstract syntax tree, the control flow graph and the program dependency graph, and integrating into a code attribute graph; for the code attribute graph, processing the code attribute graph by adopting a semantic perception sparse attention method combined with sparse attention, a learnable Token pruning method and Top-k interaction frequency to obtain a Token attention score; and based on the obtained Token attention scores, accumulating the attention score of each Token in each row of the code, and detecting and determining a statement where the vulnerability code is located. According to the detection method disclosed by the invention, the capability of modeling code semantic information and capturing a structured dependency relationship can be effectively improved, and meanwhile, the calculation complexity is remarkably reduced.

The invention discloses an intelligent contract vulnerability detection and repair system based on a heterogeneous graph neural network, and belongs to the technical field of block chain security, and the system comprises a contract analysis module, a multilayer graph construction module, a heterogeneous graph neural network module, a vulnerability feature library, a vulnerability recognition engine, an automatic repair module and a visual interface. After the source code of the intelligent contract is input, code analysis and standardization are completed by a contract analysis module; the multi-layer graph construction module constructs a contract internal heterogeneous graph, an inter-contract interaction graph and an ecosystem relation graph based on a graph theory; the heterogeneous graph neural network module learns a vulnerability feature mode; the vulnerability recognition engine combines the vulnerability feature library to realize vulnerability classification and risk assessment; the automatic repairing module generates a repairing scheme; and the visual interface realizes detection progress monitoring, result display and encrypted report export. The intelligent contract vulnerability detection and restoration system based on the heterogeneous graph neural network provided by the invention provides technical support for block chain digital asset security and ecological stability.

There are provided methods and apparatuses for a control flow execution-guided deep learning framework for binary code vulnerability detection. Reinforcement learning is to enhance the branching decision at every program state transition and create a dynamic environment to learn the dependency between a vulnerability and certain program states. An implicitly defined neural network enables state transition until convergence, which captures the structural information at a higher level.

A code review is automatically generated by a large language model given a prompt that includes code changes made to a source code program, an associated intent, and an extended context. The intent represents an issue with the code changes from a code reviewer's perspective and is predicted from a neural classifier given the code changes in a code diff format. The neural classifier is a neural encoder transformer model pre-trained on various code review datasets and fine-tuned on code diff hunks of code changes labeled with an intent.

The present application is directed towards systems and methods for cluster-based code analysis and transformation. Cluster-based analysis may group code objects based on their similarity across functional areas, such as where a code object is cloned in multiple areas (e.g. sort functions that are duplicated across areas, or reports or tables that are identical). In some implementations, objects may be grouped into clusters by type, or based on reading from or writing to a common table. In some implementations, clustering at different layers may be possible.

The systems and methods disclosed herein receives, from a computing device, operational data indicating software or hardware assets used on informational assets, and obtains set of alphanumeric characters defining operative boundaries for expected system assets, which include a set of common attributes. Using the set of attributes, a first set of AI models determines observed system assets from the operational data, each with specific features. A second set of AI models associates each information asset with the corresponding observed system assets. For each observed system asset, a third set of AI models identifies criteria within the alphanumeric characters, compares the criteria with the asset's features to identify gaps, and generates actions to ensure the observed system asset meets the identified criteria.

The invention provides a non-technician-oriented script intelligent adaptation and visual arrangement method and a non-technician-oriented script intelligent adaptation and visual arrangement system. The method comprises the following steps: acquiring a script file uploaded by a user, extracting a dependency library through an AST analysis technology, and constructing an isolation container environment; performing intelligent identification and conversion on a file path and database connection in the script to generate a standardized API call; carrying out input and output analysis on the basis of the converted script, and carrying out DAG workflow arrangement in a visual mode; performing function-level packaging and standardization processing on the script component in the workflow to realize component multiplexing and version management; and finally, configuring a scheduling strategy and carrying out automatic operation monitoring. According to the method, a script environment depends on automatic processing and intelligent path adaptation, and visual arrangement and modular multiplexing are combined, so that non-technical personnel can independently complete the whole process from AI script generation to a production-level automatic process, the problem of'last kilometer 'in script deployment is solved, and the working efficiency is improved.

Systems, methods, and other embodiments associated with adaptive code scanning are described. In one example method, a valid configuration that specifies approved parameters of use for a software component is defined. Software code is scanned to detect that the software component exists in the software code. Where the component is detected, the software code is scanned to identify implemented parameters of use for the software component. The implemented parameters are compared to the approved parameters. Based on the comparison, the software component is determined to be not implemented according to the valid configuration. Where the software component is implemented according to the valid configuration, the method automatically determines to proceed with the automated action based on the implemented parameters. The automated action is performed to adapt to the implemented parameters.

Systems and methods of scoring quality of open source software documentation are disclosed. In one aspect, a method includes downloading the open source software project code and documentation of the open source software project code, analyzing the open source software project code and the documentation, parsing the open source software project documentation into sections, validating the sections of the documentation with project or stack metrics, assessing a quality of sections of the documentation, assessing a quality of language of the documentation; and computing the quality score of the documentation based on the assessed quality of sections and assessed quality of language.

The invention relates to the field of intelligent contract vulnerability detection, in particular to an intelligent contract vulnerability detection method based on code graph fusion analysis and a graph matching network. The method comprises the steps of constructing an intelligent contract source code data set; through static analysis, extracting three different code feature information including a control flow diagram, a data flow diagram and an abstract syntax tree from the source code of the smart contract; carrying out information integration on the three extracted code features, and constructing a code graph covering wider features; on the basis of the generated code graph, a GraphCodeBerT model is used for pre-training; vectorizing a code graph which is output by the pre-training model and contains structural and semantic features through a graph embedding network; and learning the feature representation of the contract pair by using a cross-graph attention mechanism of a graph matching network to realize specific vulnerability detection of the smart contract source code. According to the invention, potential vulnerabilities can be accurately identified.

Methods and systems for assessing a software bill of materials (SBOM) include extracting package names from code of an application to identify first dependencies of the application. Package names are extracted from accesses by the application to identify second dependencies of the application. A quality score is generated for an SBOM of the application based on a comparison of the contents of the SBOM to the first dependencies and the second dependencies. An action is performed responsive to the quality score.

The invention discloses a code reconstruction method, system and device based on function recognition and a medium, and the method specifically comprises the steps: scanning a project file topological structure, and constructing a knowledge graph based on a code import relation and a technology stack feature; performing context enhancement by analyzing the code function description and combining with the knowledge graph to generate a code modification instruction set; based on the code modification instruction set, in combination with data stream sensitivity marking and performance portrait analysis, evaluating the target code to obtain an evaluation result; based on an evaluation result, matching a historical optimal practice mode through a graph neural network, and generating an optimization scheme which retains an original design style; by comparing abstract syntax tree differences between original codes and verified optimization schemes, only functional logic nodes are replaced, and legal code style features are reserved. According to the method, the efficiency and quality of code reconstruction and optimization are improved, and a more convenient, efficient and intelligent code processing tool is provided for software developers.

The invention relates to an interactive visualization method, device and equipment for fuzzy test bottleneck breakthrough, and belongs to the field of network security. According to the method, all compiling modules in a tested program are combined into a complete intermediate code, and a global view of the tested program is obtained; generating a unique label for each function by using a hash algorithm; constructing a call graph and a control flow graph, and obtaining function call instruction information by scanning a basic block of each function; carrying out pile insertion on the basic blocks; performing a fuzzy test on the tested program after compiling and instrumentation, and obtaining runtime data in real time; according to the fuzzy test runtime data and the static analysis data, data-driven visualization is carried out, and a call graph, a control flow graph and real-time execution statistical information are displayed in real time; a test engineer is assisted through an interactive chart, and fuzzy test bottleneck constraints are positioned. According to the method, a test engineer can be helped to better understand and intervene the fuzzy test process, and the fuzzy test code coverage rate and the defect detection number are improved.

The invention relates to the technical field of database security, and discloses a semantic analysis-based SQL (Structured Query Language) risk check method and device, and the method comprises the following steps: analyzing based on an input SQL statement to obtain a standardized SQL statement; constructing an abstract syntax tree according to the standardized SQL statement; extracting key semantic information according to the abstract syntax tree; obtaining a risk assessment result according to the key semantic information; and recording an audit log according to the risk assessment result. Compared with the technical problem that a traditional auditing system mainly depends on pattern matching of basic rules, and potential safety risks cannot be accurately recognized when complex SQL statements are processed, especially under the condition that multi-layer nesting and dynamic construction are included, due to the fact that the efficient semantic analysis technology and the risk assessment algorithm are combined for use, the safety risk assessment method and device have the advantages that the safety risk assessment efficiency is improved, and the safety risk assessment efficiency is improved. Therefore, the occurrence of security events is effectively avoided, the accuracy and efficiency of SQL risk check are improved, and then the security of the database is ensured.

Targeted dynamic analysis of code is provided by utilizing static analysis and dynamic analysis. A static code analysis system can operate to generate an initial analysis of code. The results of the initial analysis may be used to target a dynamic analysis system to analyze portions of code identified by the static analysis as potentially containing defects. In some cases, a preliminary dynamic analysis may be used to generate code inputs that may be utilized in future analyses to determine the inputs necessary to target particular code paths identified by a static analysis as potentially defective. Future updates to the code base may utilize the generated data to target analysis to code paths affected by the updates.

Systems are provided for implementing methods for generating and processing fix suggestions for alerts produced by code analysis tools. The methods involve receiving an alert, parsing the alert to identify relevant information, and assembling a prompt for a Large Language Model (LLM). The prompt includes a general description of the problem, a description of the alert message, a source-code location, and a request for a proposed fix to the alert. The prompt is sent to the LLM, and a response is obtained. The response includes a proposed fix comprising a set of edits to be applied to the source code and / or configuration files. The response is processed and validated, and a fix suggestion is assembled and provided based on the response. The fix suggestion includes a natural language explanation of the proposed fix, suggested source-code changes, and selectable options for accepting, rejecting, and editing the fix suggestion.

The invention provides a code generation and evaluation method and system based on RAG and a multilevel decision tree, and the method comprises the steps: integrating project related design documents, and constructing a knowledge base capable of semantic retrieval through a vectorization technology; associating business demand description with related documents in the knowledge base based on an RAG technology, and performing demand semantic enhancement to generate a technology demand cue word; receiving the technical requirement cue word by adopting a large language model so as to generate a complete code conforming to business logic; constructing a four-level decision tree evaluation system, and sequentially executing code quality scanning, deployability verification, dynamic test verification and demand satisfaction verification through an evaluation assembly line to generate an evaluation result; and generating an optimization suggestion according to the evaluation result so as to trigger an iteration generation process when the code does not pass the verification, thereby solving the problems of disjunction between code generation and business requirements, low verification efficiency and insufficient iteration optimization.