Source code vulnerability detection and repair through machine learning

Abstract

A neural classifier model is used to detect cyber-security vulnerabilities in source code that are predicted by a deep learning code generation model that has been trained on source code that may contain security vulnerabilities. When a classifier model classifies a given source code fragment as likely to contain a cyber-security vulnerability, a proposed repair for the cyber-security vulnerability is predicted from a neural decoder converter model that has been trained on non-vulnerable source code. A neural decoder transformer model is used to predict source code that repairs a cyber-security vulnerability given source code that is classified as a cyber-security vulnerability.

Description

Background Art

[0001] Machine learning models are often used to identify, predict and generate natural language based on large training data sets of text-based data. These models are often used to solve various problems such as question answering, document summarization, machine translation and reading comprehension. Machine learning models are statistical models that are trained to learn to recognize patterns in source code and make predictions. The disadvantage of these models is the large amount of real-world data required to train or generate such models, consisting of millions of data samples mined from various sources. Another disadvantage is that these models rely on the quality of the data provided to train them.

[0002] Machine learning models are often used for software engineering tasks where source code is generated for tasks such as code completion, document generation, code search, and source code generation. These models can be trained based on source code extracted from public source code repositories or crowdsourcing websites. Source code obtained from these sources can contain software vulnerabilities with high-risk cybersecurity flaws. Using such source code in the model's training dataset may cause the model to learn to generate source code containing cybersecurity vulnerabilities. Summary of the invention

[0003] This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

[0004] The vulnerability detection and repair system uses a classifier model to detect cybersecurity vulnerabilities in source code generated from a deep learning code generation model that has been trained on source code that may contain cybersecurity vulnerabilities. In one aspect, the classifier model is a neural encoder transformer model with attention that is trained to identify some cybersecurity vulnerabilities from the Common Vulnerabilities and Exposures (CVE) list and Common Weakness Enumeration (CWE) list of software vulnerabilities and flaws.

[0005] When the classifier model classifies a given source code snippet as likely to contain a cybersecurity vulnerability, a proposed fix for the cybersecurity vulnerability is predicted from the neural decoder transformer model. The neural decoder transformer model is used to predict source code that fixes the cybersecurity vulnerability when the given source code is classified as having a specific type of cybersecurity vulnerability.

[0006] These and other features and advantages will become apparent from a reading of the following detailed description and a review of the associated drawings.It should be understood that both the foregoing general description and the following detailed description are illustrative only and are not restrictive of the aspects, as claimed. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Figure 1 is a schematic diagram illustrating an exemplary vulnerability detection and remediation system.

[0008] FIG. 2A to FIG. 2B is a schematic diagram illustrating an exemplary application of a vulnerability detection and remediation system.

[0009] Figure 3 is a schematic diagram illustrating an exemplary configuration of a neural classifier model in a training and fine-tuning configuration.

[0010] Figure 4 is a schematic diagram illustrating a system for generating source code embeddings and selecting certain non-vulnerable source code samples based on embedding similarity to train a neural classifier model.

[0011] Figure 5 is a schematic diagram illustrating an exemplary configuration of a neural decoder transformer model as a restoration generation model.

[0012] Figure 6 is a flow chart illustrating an exemplary method of a vulnerability detection and remediation system.

[0013] Figure 7 is a flow chart illustrating an exemplary method for training a classifier model.

[0014] Figure 8 is a flow chart illustrating an exemplary training method for a neural encoder transformer model and a neural decoder transformer model.

[0015] Fig. 9 is a flow chart illustrating an exemplary training method for a repair generative model.

[0016] Fig.10 is a flow chart illustrating an exemplary method of detecting network security vulnerabilities and generating repaired code.

[0017] Fig.11 is a block diagram illustrating an exemplary operating environment. DETAILED DESCRIPTION

[0018] Overview

[0019] The present disclosure relates to detecting cybersecurity vulnerabilities in source code generated from deep learning machine learning models. Cybersecurity vulnerabilities are defects in source code programs that cause third parties to gain access to and / or control systems or networks associated with the source code. Software cybersecurity vulnerabilities are different from syntax errors, buffer overflows, null pointer dereferences, and thread safety violations. In one aspect, software cybersecurity flaws are software flaws listed in the CWE list (www.cwe.org) and / or cybersecurity vulnerabilities listed in the Common Vulnerabilities and Exposures (CVE) list (www.cve.org). The CVE list includes publicly available software cybersecurity vulnerabilities. The CWE list includes known software flaws. Software flaws are errors that can lead to software vulnerabilities.

[0020] A machine learning classifier model is trained to detect software cybersecurity vulnerabilities in source code generated from a deep learning machine learning model. Deep learning machine learning models are different from traditional machine learning models that do not use neural networks. Machine learning is the use and development of computer systems that are able to learn and adapt without following explicit instructions by using algorithms and statistical models to analyze and draw inferences from patterns in data. Machine learning uses different types of statistical methods to learn from data and predict future decisions. Traditional machine learning includes statistical techniques, data mining, Bayesian networks, Markov models, clustering, support vector machines, and visual data mapping.

[0021] Deep learning is different from traditional machine learning because it uses multi-level data processing through many hidden layers of a neural network to learn and interpret features and the relationships between features. Deep learning embodies neural networks, which are different from traditional machine learning techniques that do not use neural networks. There are various types of deep learning models that generate source code, such as recursive neural network (RNN) models, convolutional neural network (CNN) models, long short-term memory (LSTM) models, and neural transformers.

[0022] In one aspect, the classifier model is a neural encoder transformer model pre-trained on an unsupervised dataset of source code samples and a neural encoder transformer model fine-tuned on a supervised dataset of labeled samples of source code containing vulnerable and non-vulnerable source code. The neural encoder transformer model is trained to identify the likelihood that source code predicted or inferred from the deep learning model contains cybersecurity vulnerabilities such as CVE and CWE vulnerabilities. In the event that the neural encoder transformer identifies vulnerable source code, a neural decoder transformer model is used to predict a fix for the vulnerable source code.

[0023] Attention will now be turned to a more detailed description of the systems, methods, and components used in the vulnerability detection and remediation system.

[0024] system

[0025] Figure 1 An exemplary system 100 is illustrated that utilizes a vulnerability detection and remediation system 102. In one aspect, the vulnerability detection and remediation system 102 includes a pre-processing component 104, a classifier model 106, a source code remediation engine 114, a remediation generation model 115, and a notification engine 116. In one aspect, the vulnerability detection and remediation system 102 receives source code 120 output from a deep learning code generation model 118, and in another aspect, the system 102 receives source code 124 from a source code version control system 122.

[0026] The deep learning code generation model 118 is trained to predict or generate source code for various tasks such as code completion, code documentation, code search, etc. These tasks require understanding of source code. Source code is different from natural language (e.g., English) because programmers sometimes use arbitrary, complex, and long names to represent variables, functions, or other code elements. Source code can be learned from a large unsupervised rich corpus of code snippets from different programming languages ​​and / or from natural language code summaries, from which the model learns statistical properties of the source code, such as the grammatical rules of the programming language, and semantic information from the co-occurrence of specific variable and method names.

[0027] The source code version control system 122 is responsible for managing changes made to source code programs and other documents stored in a source code repository. The source code version control system 122 may be a file archive and web hosting facility that stores a large amount of source code, either privately or publicly. The source code programs residing in the source code repository are different and written in different programming languages. The selected source code programs are from different domains, such as, but not limited to, scientific computing, web development, data flow programming, machine learning, etc.

[0028] Changes to source code programs in source code version control system 122 are initiated through pull requests. A pull request is a request that initiates the process of integrating new source code changes into a version of a source code program stored in a source code repository. The process includes notifying other developers associated with the source code program of the proposed changes in order to seek a review of the changes from the other developers. Vulnerability detection and repair system 102 interacts with source code version control system 122 to check the proposed changes for possible cybersecurity vulnerabilities in the proposed changes.

[0029] The preprocessing component 104 processes the source code output from the deep learning code generation model 118 into syntactically correct source code snippets. In some cases, the source code output from the deep learning code generation model 118 may not be syntactically correct and may lack closing brackets, brackets, or other such code elements. The preprocessing component 104 parses the source code output from the model 118 and converts the code into syntactically correct and compatible source code snippets. The processed source code is then parsed and marked as an input embedding sequence that is input to the classifier model 106.

[0030] The classifier model 106 receives the input embedding sequence and generates a set of probabilities P(C1)…P(C n ), which indicates that the source code contains classes C1…C n 108. In one aspect, a classifier model is trained to identify a specific set of CWE and / or CVE software flaws or vulnerabilities. It should be noted that the term cybersecurity vulnerability includes both CWE flaws and CVE cybersecurity vulnerabilities.

[0031] Notification engine 116 generates message 126 indicating whether the source code contains vulnerable source code 110 or non-vulnerable source code 112. Additionally, source code repair engine 114 uses repair generation model 115 to generate suggested repairs 128 for source code 110 classified as vulnerable.

[0032] Figure 2A and 2B An exemplary system for utilizing a vulnerability detection and remediation system is illustrated. Figure 2A , a system 200 is shown in which a vulnerability detection and repair system 208 operates within an IDE 202. IDE 202 is a software development tool that provides tools for software development, such as, but not limited to, a source code editor, a compiler, a debugger, a build automation tool, etc. IDE 202 may incorporate a code completion tool that attempts to predict the next string that a developer (e.g., a user, an end user, a programmer, etc.) may type into a source code editor. Source code may be composed of various elements (e.g., keywords, delimiters, variables, methods, constants, operators, etc.) that are combined in a particular order according to the syntax of an underlying programming language to form expressions used in program statements. A deep learning source code generation model 204 receives a request from a source code editor 203 to complete a partially formed source code snippet given the context of a partially formed source code snippet, and the deep learning source code generation model 204 outputs a predicted source code snippet 206 that completes the partially formed source code snippet.

[0033] The partially formed source code snippet may include a partially formed line of source code, an expression, a statement, a method signature, a method body, etc. The vulnerability detection and repair system 208 analyzes the predicted source code snippet 206 for a software network security vulnerability and generates a repair for the network security vulnerability. If vulnerable code is detected at 210, a vulnerability notification is sent to the source code editor 203 along with the repair source code snippet.

[0034] Figure 2B A system 220 is illustrated in which a vulnerability detection and repair system 226 operates with a source code version control system 222 to identify cybersecurity vulnerabilities in the source code of a pull request 234 submitted by a developer 232. The source code version control system 222 detects the pull request and initiates a request 228 for the vulnerability detection and repair system 226 to analyze the source code subject to the pull request 234 for software cybersecurity vulnerabilities. The system 220 notifies the source code repository 224 of its findings and returns suggested fixes when software cybersecurity vulnerabilities 230 are found.

[0035] Now turn your attention to a more detailed description of the classifier model. In one embodiment, the classifier model is constructed as a Neural Encoder Transformer with Attention. Due to the type of attention used in the encoder, the Neural Encoder Transformer with Attention is more suitable for classification tasks. The encoder uses bidirectional attention, which enables the encoder to learn the relationship between the word / sub-word in the input sequence before and after they appear. The classifier is trained to interpret the internal representation of the model as a class label. Because bidirectional attention allows the internal representation of the model to depend on all other sub-words, rather than just the previous sub-word, bidirectional attention leads to better classification performance.

[0036] It should be noted that the phrases neural encoder transformer and neural encoder transformer model, neural encoder transformer with attention are used interchangeably.

[0037] Neural Encoder Transformer Model

[0038] Figure 3An exemplary neural encoder transformer model 300 is illustrated. In pre-training 301, the neural encoder transformer model learns to understand source code, relationships between different code elements, and the syntax of a programming language. The weights of the model (e.g., word / subword embeddings, attention weights (K, V, Q)) are randomly initialized and changed during pre-training based on samples in a pre-training dataset 332. The weights of the model are optimized based on a reduction cost function. A pre-training engine 334 uses a pre-training dataset of unsupervised source code samples 332 to pre-train the model for optimal weights. During fine-tuning 303, the weights calculated from the pre-training are used as initial weights and are tuned for the fine-tuning task. A fine-tuning engine 338 uses a fine-tuning dataset 336, which includes vulnerable source code and non-vulnerable source code, context associated with the code, and labels identifying the category or type of vulnerability.

[0039] The neural encoder transformer 301 includes an input layer 304, one or more encoder blocks 312, and an output layer 330. The input layer 304 includes an input embedding of an input sequence of a pre-training dataset 306 and a position embedding 308 representing the order of tokens / sub-tokens in the input embedding sequence. The input embedding sequence 306 and the position embedding 308 are combined to form a context tensor 310.

[0040] The encoder block (312A to 312B) consists of two layers. The first layer includes a masked self-attention component 314, followed by a layer normalization component 316. The second layer includes a feedforward neural network 318, followed by a layer normalization component 320. The context tensor 310 is input to the masked self-attention layer 314 of the encoder block with a residual connection to the layer normalization 316. The output of the layer normalization 316 is input to the feedforward neural network 318 with another residual connection to the layer normalization 320. The output of each encoder block (312A to 312B) is a hidden representation set 323. Then, if there are multiple encoder blocks, the hidden representation set 323 is sent through the additional encoder block.

[0041] Attention is used to decide which parts of the input sequence are important for each token / sub-token, especially when decoding long sequences, as the encoder is limited to encoding fixed-size vectors. The attention mechanism collects information about the relevant context of a given token / sub-token, and then encodes that context into a vector representing the token / sub-token. It is used to identify relationships between sub-tokens in long sequences, while ignoring other sub-tokens that are not very relevant to a given prediction.

[0042] The masked self-attention component 314 takes the context tensor 310 and weights the relevance of each token / sub-token represented in the context tensor to each other by generating an attention weight for each token / sub-token in the input embedding sequence 306. In one aspect, the attention function is a scaled dot product attention, which is mathematically described as follows:

[0043] The input consists of dimension d k The query Q, keyword K and dimension d v Q is a matrix containing the query or vector representation of a word / subword in the sequence, K is the vector representation of all words / subwords in the sequence, and V is the vector representation of all words / subwords in the sequence.

[0044] Query, keywords and values ​​with d v The output value is linearly projected h times in parallel, d v The output value is concatenated with the final value:

[0045] MultiHead(Q,K,V)=Concat(head1,…,head h )W o ,

[0046] Among them head i =Attention(QW i Q ,KW i K ,VW i V ),

[0047] The parameter matrix as well as

[0048] To reduce the training time of the neural encoder transformer, layer normalization is used between layers. The layer normalization component normalizes the input across features. The mean and standard deviation are calculated across the feature dimensions. There is a first layer of normalization 316 before the feedforward neural network 318 and a second layer of normalization 320 after the feedforward neural network 318. The feedforward neural network 318 processes each output encoding separately. The output of the top encoder block is a set of attention vectors K and V 323 representing the last hidden layer.

[0049] In the pre-trained model configuration 301, the output layer includes a linear layer 326 and a softmax layer 328 from which sub-word / term embeddings 323 are output. For fine-tuning, the neural encoder transformer model contains the same structure as the pre-trained model configuration, except for the addition of a different output layer 340. The output layer of the pre-trained model is replaced by a classification layer that learns a new weight matrix of dimension K×H from randomly initialized values, where K is the number of classes in the downstream classification task, and where H is the dimension of the output of the last encoder block.

[0050] The output layer of the pre-trained model 330 is not used because its weight matrix has a different size, which may not contain the classes of the target classification task. Instead, a new output layer 340 is used, which has a number of hidden units set to the number of classes K of the fine-tuned classification task with a softmax activation function 344. The predicted probability P for the jth class given the output of the last encoder block x and the weight matrix W corresponding to the classification layer is as follows:

[0051] P(y=j|x)=exp(x T W j +b) / [∑ k＝1…K exp(x T W k +b)], where K is

[0052] is the number of classes, W is the weight matrix of dimension K×H, H is the dimension of x, x is the output of the last encoder block, and b is the bias value.

[0053] The output layer 340 is composed of a linear layer 342 and a softmax layer 344. The linear layer 342 is a fully connected neural network that projects the raw scores output by the last layer of the neural network into a logarithmic vector. The softmax layer 344 applies the softmax function to the logarithmic vector to calculate the probability distribution P(C1)…P(C n )346. In one aspect, class represents the number of pre-configured CWE / CVE classes.

[0054] Selection of non-vulnerable code for training

[0055] A neural encoder transformer model is trained on vulnerable source code samples and non-vulnerable source code samples to learn the relationship between code elements in the two types of training samples in order to more accurately predict vulnerabilities. The quality of the training samples affects the ability of the model to learn to make predictions, especially for source code patterns that are not visible in the training samples. There are usually a large number of non-vulnerable source code samples and a small number of vulnerable source code samples. In order to improve the quality of the predictions made by the classifier model, the non-vulnerable code samples used to train the classifier are those that are closely related to the vulnerable code samples. The similarity is based on the embeddings generated by the neural encoder transformer model. This improves the false positive rate of the model or the accuracy of the model because the model is trained to be more discriminative when given a non-vulnerable code snippet that is very similar to a vulnerable snippet. This allows the model to make better predictions by filtering out secure code less often.

[0056] refer to Figure 4 , an exemplary system for generating 402 and selecting 412 non-vulnerable code samples to train a neural encoder transformer model 400 is shown. Initially, a neural encoder transformer model 406 is used to generate embeddings 408 for each non-vulnerable source code sample 404, which is stored in a database 410 along with its corresponding source code and context. The context is the source code preceding the non-vulnerable source code sample 402. A pre-trained neural encoder transformer model or a fine-tuned neural encoder transformer model generates these embeddings 408.

[0057] To select non-vulnerable source code samples, vulnerable source code samples 414 are encoded into embeddings 416 using the neural encoder transformer model 406. The search engine 418 uses the embeddings 416 of the vulnerable source code samples to find the nearest embeddings stored in the non-vulnerable embedding database 410. The corresponding non-vulnerable samples are retrieved. In one aspect, the search engine searches for the top k non-vulnerable source code samples, which are then used to train the neural encoder transformer model.

[0058] In one aspect, the search engine 418 uses an approximate nearest neighbor (ANN) technique to find the top k non-vulnerable source code samples, where k is a user-defined integer value. One such ANN technique is Approximate Nearest Neighbor Oh Yeah (ANNOY). The ANN technique utilizes a distance metric between two embeddings to determine how close one embedding is to another. The distance metric can be based on Euclidean distance, cosine similarity, Hamming distance, and / or Manhattan distance.

[0059] A non-vulnerable embedding database 410 is constructed with an index customized for efficiently searching for the closest similar embeddings. The index is based on embeddings associated with non-vulnerable source code samples. The index in the database can be transformed into a tree in a pre-configured order, and the search engine uses a tree traversal technique to search the tree to find the closest embedding that is similar to the embedding of the vulnerable source code sample.

[0060] We now turn our attention to a more detailed discussion of the machine learning model used to generate the repaired code.

[0061] Neural Decoder Transformer Model

[0062] In one embodiment, the source code repair engine is implemented as a neural decoder transformer model. The neural decoder transformer model is an autoregressive model that produces an output element at each time step based on the output of the previous time step.

[0063] The decoder neural transformer model 500 includes an input layer 502, one or more decoder blocks 504a to 504n, and an output layer 506. The decoder block 504 consists of two layers. The first layer includes a masked self-attention component 514, followed by a layer normalization component 516. The input of the masked self-attention component 514 has a residual connection to the layer normalization 516. The output of the layer normalization 518 is input to a feedforward neural network 520 having a residual connection to the layer normalization component 522. The output of the feedforward neural network is input to the layer normalization component 522.

[0064] Each word / sub-word flows through all the decoder blocks along its own path. The masked self-attention component 514 allows the neural network 520 to focus on certain features or inputs. The input of the decoder block 504 is added to the position embedding 510 forming the context tensor 512. The decoder block takes all previously generated target words / sub-words t1…t i-1 As a condition, predict each word / subword t in the target language one by one at each time step i . Therefore, after the initial time step, the input embedding is shifted to the left.

[0065] The masked self-attention component 514 masks the output embeddings from future time steps. The feed-forward neural network 520 processes each output embedding separately. Layer normalization components 516, 522 are used between layers to normalize the input across features.

[0066] The linear layer 524 projects the vector produced by the decoder stack into a log vector. Then, a softmax layer 526 converts the scores of the log vector into output probabilities 528 for each word / sub-word in the model vocabulary.

[0067] The neural decoder transformer model 500 is pre-trained using unsupervised source code samples 532, which learn to understand the source code, the relationships between source code elements in source code statements, and the syntax of the underlying source code language using a pre-training engine 530. The model 500 is then fine-tuned using a fine-tuning engine 534 for the task of predicting fixed code from vulnerable code snippets and their fixed code using a fine-tuning dataset 536.

[0068] method

[0069] Attention will now be directed to the description of various exemplary methods utilizing the systems and devices disclosed herein. The operation for these aspects can be further described with reference to various exemplary methods. It will be appreciated that, unless otherwise noted, representative methods do not necessarily have to be performed in the order presented or in any particular order. In addition, various activities described about the methods can be performed in a serial or parallel manner, or in any combination of serial and parallel operations. In one or more aspects, the method description is used for the operation of the systems and devices disclosed herein.

[0070] Figure 6 An exemplary method for implementing a vulnerability detection and repair system 600 is illustrated. Initially, a neural encoder transformer model is trained for a cybersecurity classification task (block 602). A neural decoder transformer model is trained to predict repaired code (block 604).

[0071] The neural encoder transformer model and the neural decoder transformer model are deployed in a vulnerability detection and repair system (block 606) operating in a target application (block 608). The target application may be an IDE or source code editor as shown in FIG. Figure 3 The source code version control system shown, or other applications.

[0072] We now turn our attention to a more detailed discussion of the training of the Neural Encoder Transformer Model 700. Figure 7 , a pre-training dataset of unsupervised source code samples in one or more programming languages ​​is obtained and used to train a neural encoder transformer model to learn statistical properties of the source code, such as grammatical rules of the programming language, and semantic information from co-occurrence of specific variable and method names (box 702).

[0073] The pre-training engine generates a pre-training data set from different corpora of unlabeled source code programs or files. In some aspects, the pre-training data set may also include natural language text about the source code file, such as a source code summary describing the operation of the source code construct. This is called unsupervised learning because the model draws inferences from input data without labeled input. The pre-training engine extracts selected source code files from various source code repositories. The source code file contains context beyond the method body, method signatures, and file strings, such as imports, globals, comments, and scripts. (collectively, box 702).

[0074] The pre-training engine converts each selected source code file into a specific syntax tree. The specific syntax tree represents the source code text in a parsed form. The specific syntax tree can also be a parse tree. The specific syntax tree represents the grammatical structure of the program in a hierarchical or tree structure. The specific syntax tree is an n-ary tree data structure that includes nodes that represent the structure in the syntax of the programming language of the program. The specific syntax tree includes a root node, multiple internal nodes, and multiple terminal nodes. The terminal node represents a sub-word. The sub-word is a symbol that represents an operand or operator. The specific syntax tree is different from the abstract syntax tree in which the terminal node represents an operand. (collectively, box 702).

[0075] The pre-training engine uses a sub-word token segmenter to extract tokens / sub-words from a specific syntax tree. In one aspect, the neural transformer model utilizes a byte-level byte-pair encoding token segmenter to generate sub-words representing an ordered sequence of source code fragments. Different from natural languages ​​(e.g., English, etc.), programmers sometimes use arbitrary, complex and long names to represent variables, functions or other code elements, which can lead to a very large vocabulary for the model when a large number of source code programs are used to train the model. In order to reduce the size of the vocabulary, tokens that occur less frequently are divided into sub-words. Sub-words are a part of a token between a token and a single character. Sub-words are used to illustrate rare or unknown tokens (i.e., tokens that exceed the vocabulary) that may appear in the target source code program. The use of sub-words allows the model to learn and generate tokens that exceed the vocabulary.

[0076] (collectively, box 702).

[0077] Byte-level Byte Pair Encoding (BBPE) is used to generate the vocabulary used by the neural transformer model. A text string, either a source code sequence or a natural language text, is represented as a sequence of Unicode Transformation Format (UTF-8) bytes. The input text string of sub-words is encoded into a sequence of UTF-8 bytes, where the sub-words are encoded into one to four bytes. The byte sequence is then segmented into byte-level sub-words, known as byte n-grams. (collectively, box 702).

[0078] Byte-level subwords are generated using a byte pair encoding (BPE) algorithm. The vocabulary is seeded with 256 American Standard Code for Information Interchange (ASCII) characters and then greedily grows by adding the most common contiguous word pairs in each iteration. This type of encoding does not rely on knowing the underlying language that makes it suitable for the input sequence of text strings containing source code and / or natural language text. The ordered sequence of UTF-8 bytes is translated into a T-ordered sequence of subwords, which is a vector representation of a source code segment or natural language text. The T-ordered sequence of subwords is represented in a context vector. (collectively, box 702).

[0079] Each source code program in the training data set does not need to be written in the same programming language. The training data set can be composed of multiple source code programs, and each source code program can be written in different programming languages. Each source code program in the training data set is encoded as a sequence composed of word units and / or sub-word units. Frequently used elements in the programming language are encoded into word units, and less frequently occurring elements are encoded into character combinations that are called sub-word units. This reduces the need to store large vocabularies and provides better accuracy to super-vocabulary word units. For simplicity, the term sub-word unit should include word units and sub-word units. (collectively, frame 702).

[0080] Then, a noise transformation such as a span masking function is applied to each sequence of randomly masking a subset of sub-words, and the masked spans of the sub-words are replaced by masked sub-words M. The model is trained with masked sequences to learn to reconstruct the original sequence without masked sub-words. In one aspect, masked sub-words replace the spans of sub-words. The number and span length of text spans are randomly generated and each span is replaced by a single masked sub-word. Mask denoising is based on a cloze task that evaluates the proficiency of human language learners, in which humans are given a foreign language with missing words and are required to correctly select the missing words. The benefit of span mask denoising in pre-training is that the model learns the desired language in an unsupervised manner and is bidirectional in the sense that it learns the relationship before and after the word appears. (collectively, box 702).

[0081] Steering Figure 8 , an exemplary method 800 for training a neural transformer model using a pre-training dataset and a fine-tuning dataset is shown. The method can be applied by a pre-training engine and a fine-tuning engine to pre-train and fine-tune a neural encoder transformer model and / or a neural decoder transformer model.

[0082] The Neural Transformer model is trained iteratively, making multiple passes over the training dataset before converging to a minimum. An epoch represents one pass of the entire training dataset forward and backward through the Neural Transformer block. Since the training dataset is very large, it is split into smaller batches. Training is iterative, and the entire dataset is passed through the Neural Transformer in multiple iterations. Each training iteration includes a forward propagation, loss calculation, a backpropagation step, and then an update of the weights. The training dataset is split into batches, and each batch sequence is run through the training process. (collectively, box 802).

[0083] The neural transformer model has multiple blocks and layers within each block so that more detailed relationships within the data are learned and how features interact with each other at a non-linear level. The model structure, training process, data normalization, and vocabulary encoding process are hyperparameters that are customized to meet specific goals. The parameters of the model are the values ​​of the model, such as attention weights (K, V, Q) and word embeddings (We, Wp). Hyperparameters affect how the model is built and how the parameters are learned. (Collectively, box 802).

[0084] In one aspect, the hyperparameters may include the following: (1) the dimensions of the sub-word and position embedding layers; (2) the configuration of the neural transformer model with multiple encoder blocks and / or decoder blocks in a particular configuration; (3) for the training process: the cross entropy loss optimization target; the sequence length; the mini-batch size; the gradient accumulation step for each weight update; the stochastic optimization process used to train the feed-forward neural network; and the learning rate; (4) the data normalization process; and (5) the vocabulary encoding process: byte-level byte pair encoding. (collectively, block 802).

[0085] For each sequence of each batch of each epoch (blocks 804, 806), the T-ordered sequence of sub-words is then mapped into a digital vector, and then mapped into corresponding sub-word embeddings and position embeddings (block 808). Embeddings are learned representations of sub-words based on text, where sub-words with common meanings have common representations. Embeddings are mappings of discrete categorical variables to continuous digital vectors. An embedding and corresponding position embedding exist for each sub-word in the vocabulary. The sub-word embeddings represent learned representations for sub-words. The neural transformer model does not read each sub-word sequentially, and therefore, does not know the position of the sub-word in the sequence without additional position information. Position embeddings are used to embed position information about the position of the sub-word in the sequence into the corresponding neural transformer model.

[0086] Initial values ​​for the sub-word embedding and position embedding for each sequence are generated and then used to form the context tensor. Thereafter, the neural transformer model learns the values ​​for each embedding. At the completion of the training phase, the embedding and position embedding for each sub-word are saved into corresponding matrices for later use. There is a sub-word embedding matrix We containing the embeddings for each sub-word t i , the embedding vectors for i=0…V, and the position embedding matrix Wp, which contains the embedding vector P for each position j , j = 0 ... T, where V is the size of the vocabulary and T is the length of the subword-tuple sequence. (collectively, block 808).

[0087] The context tensor is input into the corresponding neural transformer model and passes through multiple layers of the neural transformer model. For the encoder neural transformer model, the masked self-attention layer takes the context tensor as input and passes it through multiple layers of self-attention, layer normalization, and feed-forward neural networks of each encoder block to ultimately produce a set of hidden representations. (collectively, box 810).

[0088] The feedforward neural network in the encoder / decoder block is trained iteratively, passing multiple times on the training data set before converging to a minimum. Each training iteration includes a forward propagation, loss calculation, back propagation step, and then updating the weights by calculating the weight gradient. The loss function estimate is used to compare the loss or error of the prediction result. In one aspect, a categorical cross entropy loss function is used. Once the loss is calculated, it is back propagated to the hidden layer that directly contributes to the output. In back propagation, the partial derivative of the loss function with respect to the trainable parameters is determined. The weighted gradient is calculated as the difference between the old and new values ​​of the weights. The weights are adjusted using a gradient descent technique to minimize the loss as much as possible. In one aspect, the stochastic gradient descent (SGD) method is an optimization algorithm used to find the parameter values ​​of the function that minimizes the loss function. The back propagation algorithm can be used to update the weights. (collectively, box 810).

[0089] At the completion of each batch, the parameters of the corresponding neural transformer model are updated at a preconfigured frequency denoted as Naccum. Naccum is the gradient accumulation frequency. The parameters include word / sub-word embeddings and position embeddings stored in the corresponding embedding matrix. (collectively, box 812).

[0090] Next, the neural transformer model is validated. Prior to training the neural transformer model, a set of hyperparameters are randomly selected and then adjusted to achieve the desired performance. The neural transformer model is tested using a validation data set to determine the appropriate hyperparameter settings to achieve the desired goal. When the desired goal is not achieved, one or more hyperparameters are adjusted and training is repeated until the desired goal is achieved. The perplexity on the validation set is calculated to verify the performance of the model with respect to learning the masked original text. (collectively, box 814).

[0091] Return to Figure 7 , vulnerable source code training samples are obtained from various sources, such as CodeQL, CVEfixes datasets, and GitHub Issues data. CodeQL is a software analysis engine provided by github that finds source code snippets in a specified code base with a specified vulnerability. In one aspect, CodeQL is queried to find vulnerable source code with any of the CVE and CWE vulnerabilities listed in Appendix A from various public source code repositories. The CVEfixes dataset is a relational database of well-known network security vulnerabilities and corresponding fixes. Data from the CVEfixes dataset is derived from CVE records in the public National Vulnerability Database (NVD). NVD is a U.S. government repository of security-related software flows and other related information. (collectively, box 704).

[0092] Github is an open source repository and toolset for collaboratively maintaining source code, and GitHub Issues is a forum for discussing any issues or questions related to the specific source code being discussed. Maintainers of popular repositories often categorize these issues on their repositories in GitHub Issues to confirm the validity of the issues raised, which provides another source to build another dataset of known vulnerabilities found in open source software. (collectively, box 704).

[0093] Additionally, the source code repository can be mined for source code snippets that have been modified to correct a cybersecurity vulnerability. To find such source code snippets, the CodeQL program can be run on the commit history of the source code repository. The commit history shows the commits performed on the source code files of the repository. A commit is an operation that checks for modified versions of source code files returned to the source code repository. The CodeQL program analyzes the modifications to the source code program from each commit to identify the cybersecurity vulnerability and the original source code program that contained the vulnerability.

[0094] (collectively, box 704).

[0095] For each vulnerable source code sample, several similar non-vulnerable code samples are obtained from a non-vulnerable embedding database. In one aspect, a pre-trained neural encoder transformer model is used to generate embeddings for each vulnerable source code sample and non-vulnerable source code sample. (collectively, block 706).

[0096] The vulnerable code embedding is then used to find the closest similar embedding of the non-vulnerable source code in the non-vulnerable embedding database. The corresponding source code and context of each closest similar embedding is used as a non-vulnerable source code sample for fine-tuning the dataset. (collectively, block 708).

[0097] A fine-tuning dataset is then constructed from the non-vulnerable source code snippets and the vulnerable source code snippets. Each input sequence in the fine-tuning dataset includes source code preceding the vulnerable or non-vulnerable source code snippet (referred to as context), the vulnerable or non-vulnerable source code snippet, and a label. The label indicates a vulnerable classification type or a pre-configured code indicating "non-vulnerable source code" (collectively, block 710).

[0098] The fine-tuning dataset is divided into input sequences for training, testing, and validation subsets. The input sequence is constructed in the same manner as the pre-training dataset for the pre-trained model. The source code snippet is parsed to form a concrete syntax tree from which tokens / sub-tokens are extracted. Byte-level byte pair encoding is used to form sub-tokens. An ordered sequence of sub-tokens is formed with corresponding contexts and labels to form a supervised fine-tuning dataset. (collectively, box 712).

[0099] The fine-tuning dataset is then used to tune the weights or parameters of the neural encoder transformer model and each input sequence is applied as described above for Figure 8 The neural encoder transformer model described (block 712).

[0100] In the event that the fine-tuned neural encoder transformer model does not perform as expected (block 714-yes), the model may be fine-tuned with a different fine-tuning dataset. The fine-tuned neural encoder transformer model may be used for vulnerable source code samples, and for generating new embeddings for embeddings of non-vulnerable source code stored in a non-vulnerable embedding database (block 716). The process is then repeated by finding the closest similar non-vulnerable code based on the new embeddings, and fine-tuning the neural encoder transformer model again with the new fine-tuning dataset (blocks 708 to 712). The process is repeated until a convergence criterion is achieved.

[0101] We now turn our attention to describing the training of the inpainting generative model in more detail.

[0102] Steering Fig. 9 , an exemplary method of training a repair training generative model 900 is shown. In one aspect, a source code repair engine is configured as a neural decoder transformer model with attention. The neural decoder transformer model may be pre-trained with an unsupervised training dataset of source code snippets from source code programs known to have non-vulnerable source code. Alternatively, an existing neural decoder transformer model previously trained on source code snippets may be obtained, thereby eliminating the need for a pre-trained source code domain model. (collectively, block 902).

[0103] The neural decoder transformer model is then fine-tuned on source code snippets with software cybersecurity vulnerabilities and source code that fixes the vulnerable code. The vulnerable source code snippets and their corresponding repaired code can be obtained from one or more of the following sources: a CVE repair dataset; source code mined from a public source code repository; and self-supervised training samples. The CVE repair dataset is a public collection of cybersecurity vulnerabilities found in source code programs in different programming languages ​​with exemplary repaired versions of vulnerable code. Self-supervised training samples are created from non-vulnerable source code snippets that are modified to contain cybersecurity vulnerabilities. The non-vulnerable source code snippets and the synthetic vulnerable code are used as part of the fine-tuning dataset. (Collectively, box 904).

[0104] Additionally, the source code repository can be mined for source code snippets that have been modified to correct a network security vulnerability. The modified source code snippets and the original version of the code with the vulnerability are used as part of the fine-tuning dataset. To find such source code snippets, a CodeQL program can be run on the commit history of the source code repository. It should be noted that other source code analyzers besides CodeQL can be used.

[0105] The commit history shows the commits performed on the source code files. A commit is the operation of checking a modified version of a source code file back into the source code repository in the source code repository. The CodeQL program analyzes the modifications to the source code program from each commit to identify network security vulnerabilities. When a network security vulnerability is identified, the modified code is used as the fixed code and the original code is considered vulnerable code. (Generally, block 904).

[0106] A fine-tuning dataset is generated from each pair of vulnerable code and its corresponding non-vulnerable code (block 906). Figure 8 The fine-tuning dataset is applied to the neural decoder transformer model in a similar manner as shown and described (block 908 ).

[0107] Fig.10An exemplary method of a vulnerability detection and repair system 1000 is illustrated. The method receives source code to analyze network security vulnerabilities. The source code can come from a deep learning code generation model or from a pull request (block 1002).

[0108] The preprocessing component parses the source code into a syntax tree, extracts tokens / sub-tokens from the tree to generate an input sequence of sub-tokens. Each token / sub-token in the input sequence is replaced with a corresponding token / sub-token embedding, and the embedding sequence is applied to a classifier model. The classifier model generates a probability distribution of classes of network security vulnerabilities, which is used to identify the likelihood of vulnerabilities in the source code. (collectively, block 1004).

[0109] The source code repair engine predicts repair source code for source code snippets classified as vulnerable code. The source code repair engine parses the vulnerable code into a syntax tree, extracts tokenized sub-words from the tree, and then inputs them into an input sequence. Each sub-word is replaced with a corresponding embedding to form an input embedding that is applied to the neural decoder transformer model. (collectively, block 1006).

[0110] The source code repair engine uses beam search to generate candidates as repaired code. Based on conditional probabilities, candidates are generated one word at a time at each time step. Beam search uses the probability distribution generated by the neural decoder transformer model at each time step to identify the first k sub-words that may be the next sub-word in the candidate sequence. Beam search expands the search by instantiating a new partial sequence using each word in the selected sub-words identified by the probability distribution of the neural decoder transformer model. The search continues to generate new partial sequences from the first k sub-words identified by the output distribution from the neural decoder transformer model until the search ends. The search can end when a completed word appears as the most likely next sub-word. When the partially formed candidate sequence has formed a complete expression, the completed word sends a signal. The completed word can be the end of a line, the end of a statement, the end of a method, or other completed sub-word. (Collectively, box 1006).

[0111] Beam search uses breadth-first search to build a search tree. The search tree consists of nodes at one or more inference levels. Each node represents a probability distribution generated by the neural decoder transformer model for sub-words in the model vocabulary. At each level, only the top k sub-words with the highest probability from the output distribution generated by the neural decoder transformer model are extended to the next inference level. The variable k is preconfigured and is called the beam width. Each of the k sub-words is then expanded to a search that updates the current context sequence with the selected sub-word to input into the neural decoder transformer model to generate additional probability distributions for the next sub-word in the sequence. Repeat this process until a completed word (such as the end of a line, the end of a statement, the end of a method, or other completed word) is predicted as the next possible sub-word candidate. (Collectively, box 1006).

[0112] The repaired code and / or notification is then sent back to the target application (block 1008).

[0113] Technical Effects

[0114] Aspects of the subject matter disclosed herein relate to the technical problem of identifying cybersecurity vulnerabilities in source code generated from a deep learning code generation model.

[0115] The technical feature associated with solving this problem is a classifier model that is trained to detect specific types of cybersecurity vulnerabilities and flaws in source code, where the classifier model is trained from a training data set using non-vulnerable source code that is closely associated with source code with known cybersecurity vulnerabilities. Using embeddings generated from different stages of the classifier model to determine non-vulnerable source code that is very similar to known vulnerable source code samples improves the false positive rate of the model or the accuracy of the model because it is trained to be more discriminative when given non-vulnerable code snippets that are very similar to vulnerable snippets. This training allows the model to learn to make better predictions.

[0116] The technical effect achieved is early detection of vulnerable code before it is released. It is not possible to always know the type of data that a deep learning code generation model is trained on and the quality of the source code predicted. Even if a deep learning code generation model is trained on vulnerable code, the model may not always generate vulnerable code. The use of the techniques described herein accounts for the lack of information about the training dataset for the code generation model.

[0117] The training of deep learning code generation models is an expensive endeavor that consumes a considerable amount of computing resources and computing time. The techniques described herein allow for the continuous use of code generation models, regardless of the code used to train the model. Furthermore, early detection of vulnerable code reduces the computing resources and time required to remediate problems that may be caused by any vulnerable code remaining in the predicted source code.

[0118] Exemplary Operating Environment

[0119] Attention now turns to a discussion of exemplary operating environment 1100 . Fig.11 An exemplary operating environment 1100 with one or more computing devices 1102 communicatively coupled to a network 1104 is illustrated.

[0120] The computing device 1102 can be any type of electronic device, such as, but not limited to, a mobile device, a personal digital assistant, a mobile computing device, a smart phone, a cellular phone, a handheld computer, a server, a server array or server farm, a web server, a network server, a blade server, an Internet server, a workstation, a minicomputer, a mainframe computer, a supercomputer, a network appliance, a web appliance, a distributed computing system, a multiprocessor system, or a combination thereof. The operating environment 1100 can be configured in a network environment, a distributed environment, a multiprocessor environment, or a stand-alone computing device with access to a remote or local storage device.

[0121] The computing device 1102 may include one or more processors 1106, one or more communication interfaces 1108, one or more storage devices 1110, one or more input / output devices 1112, and one or more memory devices 1114. The processor 1106 may be any commercially available or custom processor, and may include dual microprocessors and multi-processor architectures. The communication interface 1108 facilitates wired or wireless communication between the computing device 1102 and other devices. The storage device 1110 may be a computer-readable medium that does not contain a propagation signal, such as a modulated data signal transmitted by a carrier wave. Examples of storage devices 1110 include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical storage, cassettes, tapes, disk storage, all of which do not contain a propagation signal, such as a modulated data signal transmitted by a carrier wave. There may be multiple storage devices 1110 in the computing device 1102. The input / output device 1112 may include a keyboard, a mouse, a pen, a voice input device, a touch input device, a display, a speaker, a printer, etc., and any combination thereof.

[0122] The memory device 1114 may be any non-transitory computer-readable storage medium that can store executable programs, applications, and data. The computer-readable storage medium does not involve propagation signals, such as modulated data signals transmitted by carrier waves. It may be any type of non-transitory memory device (e.g., random access memory, read-only memory, etc.), magnetic memory, volatile memory, non-volatile memory, optical memory, DVD, CD, floppy disk drive, etc. that does not involve propagation signals (such as modulated data signals transmitted by carrier waves). The memory device 1114 may also include one or more external memory devices or remotely located memory devices that do not involve propagation signals, such as modulated data signals transmitted by carrier waves.

[0123] Memory device 1114 may contain instructions, components, and data. Components are software programs that perform specific functions and are otherwise referred to as modules, programs, components, and / or applications. Memory device 1114 may contain operating system 1116, deep learning source code generation model 1118, source code version control system 1120, preprocessing component 1122, classifier model 1124, source code repair engine 1126, notification engine 1128, pre-trained data set 1130, fine-tuning data set 1132, pre-trained engine 1134, fine-tuning engine 1136, IDE 1138, repair generation model 1140, non-vulnerable embedded database 1142, search engine 1144, and other applications and data 1146.

[0124] The computing device 1102 may be communicatively coupled via a network 1104. The network 1104 may be configured as an ad hoc network, an intranet, an extranet, a virtual private network (VPN), a local area network (LAN), a wireless LAN (WLAN), a wide area network (WAN), a wireless WAN (WWAN), a metropolitan area network (MAN), the Internet, a portion of a public switched telephone network (PSTN), a plain old telephone service (POTS) network, a wireless network, network or any other type of network or combination of networks.

[0125] The network 1104 may employ various wired and / or wireless communication protocols and / or technologies. The various generations of different communication protocols and / or technologies that may be employed by the network may include, but are not limited to, Global System for Mobile Communications (GSM), General Packet Radio Service (GPRS), Enhanced Data GSM Environment (EDGE), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (W-CDMA), Code Division Multiple Access 2000 (CDMA-2000), High Speed ​​Downlink Packet Access (HSDPA), Long Term Evolution (LTE), Universal Mobile Telecommunications System (UMTS), Evolution-Data Optimized (Ev-Do), Worldwide Interoperability for Microwave Access (WiMax), Time Division Multiple Access (TDMA), Orthogonal Frequency Division Multiplexing (OFDM), Ultra-Wideband (UWB), Wireless Application Protocol (WAP), User Datagram Protocol (UDP), Transmission Control Protocol / Internet Protocol (TCP / IP), any portion of the Open Systems Interconnection (OSI) model protocols, Session Initiation Protocol / Real-time Transport Protocol (SIP / RTP), Short Message Service (SMS), Multimedia Messaging Service (MMS), or any other communication protocol and / or technology.

[0126] in conclusion

[0127] A system is disclosed, comprising: one or more processors; and a memory storing one or more programs configured to be executed by the one or more processors. The one or more programs include instructions that perform actions for: accessing a pre-trained neural classifier model; obtaining at least one cybersecurity vulnerability source code sample and multiple non-vulnerable source code samples; generating embeddings for at least one cybersecurity vulnerability source code sample and for each non-vulnerable source code sample in multiple non-vulnerable source code samples; selecting a non-vulnerable source code sample in multiple non-vulnerable source code samples that has an embedding similar to the embedding of the cybersecurity vulnerability source code sample; and fine-tuning the pre-trained neural classifier model with the at least one cybersecurity vulnerability source code sample and the selected non-vulnerable source code sample in multiple non-vulnerable source code samples, wherein the fine-tuned neural classifier model learns to predict whether a given source code snippet includes non-vulnerable code or a cybersecurity vulnerability.

[0128] In one aspect, a pre-trained neural classifier model is trained with a plurality of unsupervised source code samples. In one aspect, the network security vulnerability comprises at least one Common Vulnerability Exposure (CVE) vulnerability. In one aspect, the network security vulnerability comprises at least one Common Weakness Enumeration (CWE) vulnerability.

[0129] In one aspect, one or more programs include instructions that perform actions for: using a pre-trained neural classifier model to generate an embedding for at least one cybersecurity vulnerability source code sample and for each non-vulnerable source code sample in a plurality of non-vulnerable source code samples. In one aspect, one or more programs also include instructions that perform actions for: using a fine-tuned classifier model to generate a second embedding for at least one cybersecurity vulnerability source code sample and for each non-vulnerable source code sample in a plurality of non-vulnerable source code samples; reselecting a non-vulnerable source code sample in a plurality of non-vulnerable source code samples that has a second embedding similar to the second embedding of the at least one cybersecurity vulnerability source code sample; and re-adjusting the fine-tuned classifier model with the at least one cybersecurity vulnerability source code sample and the reselected non-vulnerable source code sample in the plurality of non-vulnerable source code samples.

[0130] In one aspect, the one or more programs further include instructions that perform actions for: deploying a neural classifier model in an integrated development environment to identify vulnerable code predicted from a deep learning code generation model. In one aspect, the one or more programs further include instructions that perform actions for: deploying a neural classifier model in a source code version control system to identify vulnerable code in a commit record. In one aspect, the neural classifier model is a neural encoder transformer model with attention.

[0131] A computer-implemented method is disclosed, comprising: accessing a non-vulnerable embedding database having a plurality of embeddings, each embedding being associated with a non-vulnerable source code sample, the non-vulnerable source code sample being associated with a non-vulnerable classification; generating an embedding for each vulnerable source code sample in the plurality of vulnerable source code samples, each vulnerable source code sample in the plurality of vulnerable source code samples being associated with a vulnerability classification; searching the non-vulnerable embedding database for a closest matching embedding for each vulnerable source code sample in the plurality of vulnerable source code samples; constructing a first fine-tuning dataset, the first fine-tuning dataset comprising the plurality of vulnerable source code samples and non-vulnerable source code samples, the non-vulnerable source code samples having the closest matching embeddings to the corresponding vulnerable source code samples; and fine-tuning a pre-trained neural classifier model with the fine-tuning dataset to identify the likelihood of a given source code snippet being associated with a vulnerability classification or a non-vulnerable classification.

[0132] In one aspect, the computer-implemented method further comprises: pre-training a neural classifier model on a plurality of unsupervised source code samples. In one aspect, the vulnerability classification comprises: at least one Common Vulnerabilities and Exposures (CVE) vulnerability and / or at least one Common Weakness Enumeration (CWE) vulnerability.

[0133] In one aspect, the computer-implemented method further comprises: generating each of the embeddings of the non-vulnerable source code samples in the non-vulnerable embedding database using a pre-trained neural classifier model. In one aspect, the computer-implemented method further comprises: regenerating the embeddings of the non-vulnerable source code samples and the vulnerable source code samples using the fine-tuned neural classifier model; reselecting a non-vulnerable source code sample from a plurality of non-vulnerable source code samples having a regenerated embedding similar to the regenerated embedding of each of the network security vulnerability source code samples; and re-adjusting the fine-tuned classifier model with the reselected non-vulnerable source code samples and the vulnerable source code samples having the similar regenerated embeddings.

[0134] In one aspect, the pre-trained classifier model is a Neural Encoder Transformer with Attention.

[0135] A computer-implemented method is disclosed, comprising: obtaining a predicted source code snippet generated from a deep learning code generation model to complete a partially formed source code snippet in a source code editing session; identifying, by a neural classifier model, a likelihood that the predicted source code snippet includes vulnerable code; given the source code snippet, using a neural transformer model to predict repaired code to remediate the predicted source code snippet that includes the vulnerable code; and displaying the repaired code in the source code editing session to complete the partially formed source code snippet.

[0136] In one aspect, the vulnerable code is associated with a Common Vulnerabilities and Exposures (CVE) vulnerability. In one aspect, the vulnerable code is associated with a Common Weakness Enumeration (CWE) vulnerability. In one aspect, the neural transformer model is a neural decoder transformer model with attention. In one aspect, the neural classifier model is a neural encoder transformer model with attention.

[0137] Although the subject matter has been described in language specific to structural features and / or methodological acts, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Instead, the specific features and acts described above are disclosed as example forms of implementing the claims.

[0138] Appendix A - Software Network Security Vulnerabilities

[0139] CVE-2018-1281 - Bind to all interfaces

[0140] CWE-020 - External API used with untrusted data CWE-020 - Incomplete hostname regular expression

[0141] CWE-020 - Incomplete URL Scheme Check

[0142] CWE-020 - Incomplete URL Substring Sanitization

[0143] CWE-020 - Improper Suffix Check

[0144] CWE-020 - Missing Regular Expression Anchor

[0145] CWE-020 - Untrusted Data to External API

[0146] CWE-020 - Unused Regular Expression Character Escape

[0147] CWE-020 - External API - External API used with untrusted data

[0148] CWE-020 - External API - Untrusted Data to External API CWE-022 - Path Injection CWE-022 - Tainted Path

[0149] CWE-022-tar slip

[0150] CWE-022-zip slip

[0151] CWE-073 - Template Object Injection

[0152] CWE-078 - Command Injection

[0153] CWE-078 - Indirect Command Injection

[0154] CWE-078 - Shell Commands Constructed from Environment

[0155] CWE-078 - Insecure Shell Command Construction

[0156] CWE-078 - Unwanted use of cat

[0157] CWE-079-Unusual Cross-Site Scripting Attack

[0158] CWE-079 - Jinja2 No Escape

[0159] CWE-079-Reflected Cross-Site Scripting Attack

[0160] CWE-079-Stored Cross-Site Scripting Attack

[0161] CWE-079 - Insecure HTML Construction

[0162] CWE-079 - Unsafe jQuery Plugin

[0163] CWE-079 - Cross-site scripting attack

[0164] CWE-079 - Reinterpretation of DOM Text as HTML

[0165] CWE-089 - SQL Injection

[0166] CWE-090 - LDAP Injection

[0167] CWE-094 - Code Injection

[0168] CWE-094 - Improper Code Sanitization

[0169] CWE-094 - Insecure Code Construction

[0170] CWE-094 - Insecure Dynamic Method Access

[0171] CWE-1004 - Client-side Cookie Exposure

[0172] CWE-116 - Improper Tag Filtering

[0173] CWE-116 - Double Escape

[0174] CWE-116 - Incomplete Html Attribute Sanitization

[0175] CWE-116 - Incomplete Multi-Character Sanitization CWE-116 - Incomplete Sanitization

[0176] CWE-116 - Unsafe HTML Extension

[0177] CWE-117 - Log Injection

[0178] CWE-1275 - Cookie with SameSite of None

[0179] CWE-134 - Tainted Format String

[0180] CWE-200 - File Access to Http

[0181] CWE-200 - Private File Exposure

[0182] CWE-201-Post Message

[0183] CWE-209 - Stack Trace Disclosure

[0184] CWE-215 - Flask Debugging

[0185] CWE-295 - Disable Certificate Validation

[0186] CWE-295 - Missing Host Key Validation

[0187] CWE-295 - Unauthenticated Request

[0188] CWE-300 - Insecure Dependency Resolution

[0189] CWE-312 - Build Artifact Disclosure

[0190] CWE-312 - Plaintext Logging

[0191] CWE-312 - Plaintext Storage

[0192] CWE-313 - Passwords in Configuration Files

[0193] CWE-326 - Insufficient Key Length

[0194] CWE-326 - Weak Cryptographic Keys

[0195] CWE-327 - Bad Randomness

[0196] CWE-327 - Broken Weak Cryptographic Algorithm

[0197] CWE-327 - Insecure Default Protocol

[0198] CWE-327 - Insecure Protocol

[0199] CWE-327 - Weak Sensitive Data Hash

[0200] CWE-338 - Insecure Randomness

[0201] CWE-346 - Cors Misconfiguration for Certificates

[0202] CWE-347 - Missing JWT Key Validation

[0203] CWE-352 - Missing CSRF Middleware

[0204] CWE-367 - File System Race

[0205] CWE-377 - Insecure Temporary Files

[0206] CWE-384 - Session Fixation Attack

[0207] CWE-400 - Deep Object Resource Exhaustion

[0208] CWE-400 - Remote Property Injection

[0209] CWE-451 - Missing XFrame option

[0210] CWE-502 - Insecure Deserialization

[0211] CWE-506 - Hard-coded Data Interpreted as Code

[0212] CWE-598 - Sensitive GET Query

[0213] CWE-601 - Client URL Redirection

[0214] CWE-601 - Server-side URL redirection

[0215] CWE-601 - Url Redirection

[0216] CWE-611 - XML ​​External Entity

[0217] CWE-614 - Plaintext Transmission of Sensitive Cookies

[0218] CWE-640 - Host Header Poisoning in Email Generation

[0219] CWE-643 - Xpath Injection

[0220] CWE-730 - Polynomial Re Do S

[0221] CWE-730-Re Do S

[0222] CWE-730 - Regular Expression Injection

[0223] CWE-730 - Regular Expression Injection

[0224] CWE-730 - Server Crash

[0225] CWE-732 - Weak File Permissions

[0226] CWE-754 - Unvalidated Dynamic Method Invocation

[0227] CWE-770 - Missing Rate Limiting

[0228] CWE-776 - XML ​​Bomb

[0229] CWE-798 - Hardcoded Credentials

[0230] CWE-807 - Conditional Bypass

[0231] CWE-807 - Different Type Comparison Bypass

[0232] CWE-829 - Insecure Download

[0233] CWE-830 - Function from Untrusted Source

[0234] CWE-834 - Loop Boundary Injection

[0235] CWE-843 - Type confusion caused by parameter tampering

[0236] CWE-862 - Empty password in configuration file

[0237] CWE-912 - Http to write file

[0238] CWE-915 - Prototype Tainted Assignment

[0239] CWE-915 - Prototype-tainted Function

[0240] CWE-915 - Prototype Pollution Merge Call

[0241] CWE-916 - Use of Computationally Inefficient Password Hash

[0242] CWE-918 - Client Request Forgery

[0243] CWE-918 - Full Server-Side Request Forgery

[0244] CWE-918 - Partial Server-Side Request Forgery

[0245] CWE-918 - Request Forgery

Claims

1. A system comprising: one or more processors; as well as a memory storing one or more programs configured to be executed by the one or more processors, the one or more programs comprising instructions that perform actions for: Access pre-trained neural classifier models; obtaining at least one cybersecurity vulnerable source code sample and a plurality of non-vulnerable source code samples; generating an embedding for the at least one network security vulnerability source code sample and for each non-vulnerable source code sample in the plurality of non-vulnerable source code samples; selecting a non-vulnerable source code sample of the plurality of non-vulnerable source code samples having an embedding similar to the embedding of the network security vulnerability source code sample; as well as The pre-trained neural classifier model is fine-tuned using the at least one network security vulnerability source code sample and the selected non-vulnerable source code sample from among the multiple non-vulnerable source code samples, wherein the fine-tuned neural classifier model learns to predict whether a given source code snippet includes non-vulnerable code or a network security vulnerability.

2. The system of claim 1, wherein the pre-trained neural classifier model is trained with a plurality of unsupervised source code samples.

3. The system of claim 1, wherein the network security vulnerability comprises at least one Common Vulnerabilities and Exposures (CVE) vulnerability.

4. The system of claim 1, wherein the network security vulnerability comprises at least one Common Weakness Enumeration (CWE) vulnerability.

5. The system of claim 1 , wherein the one or more programs include instructions that perform actions for: The pre-trained neural classifier model is utilized to generate the embedding for the at least one network security vulnerability source code sample and for each source code sample in the plurality of non-vulnerable source code samples.

6. The system of claim 1, wherein the one or more programs include further instructions that perform actions for: utilizing the fine-tuned classifier model to generate a second embedding for the at least one network security vulnerability source code sample and for each non-vulnerable source code sample in the plurality of non-vulnerable source code samples; reselecting a non-vulnerable source code sample from the plurality of non-vulnerable source code samples having a second embedding similar to the second embedding of the at least one network security vulnerability source code sample; as well as The fine-tuned classifier model is re-adjusted using the at least one network security vulnerability source code sample and the re-selected non-vulnerable source code sample from among the plurality of non-vulnerable source code samples.

7. The system of claim 1, wherein the one or more programs include further instructions that perform actions for: The neural classifier model is deployed in an integrated development environment to identify vulnerable code predicted from a deep learning code generation model.

8. The system of claim 1, wherein the one or more programs include further instructions that perform actions for: The neural classifier model is deployed in a source code version control system to identify vulnerable code in commit records.

9. The system of claim 1, wherein the neural classifier model is a neural encoder transformer model with attention.

10. A computer-implemented method comprising: accessing a non-vulnerable embedding database having a plurality of embeddings, each of the embeddings being associated with a non-vulnerable source code sample, the non-vulnerable source code sample being associated with a non-vulnerable classification; generating an embedding for each vulnerable source code sample in a plurality of vulnerable source code samples, each vulnerable source code sample in the plurality of vulnerable source code samples being associated with a vulnerability classification; For each vulnerable source code sample in the plurality of vulnerable source code samples, searching the non-vulnerable embedding database for a closest matching embedding; constructing a first fine-tuning dataset, the first fine-tuning dataset comprising the plurality of vulnerable source code samples and the non-vulnerable source code samples, the non-vulnerable source code samples having embeddings that most closely match corresponding vulnerable source code samples; as well as A pre-trained neural classifier model is fine-tuned with the fine-tuning dataset to identify a likelihood of a given source code snippet being associated with a vulnerable classification or a non-vulnerable classification.

11. The computer-implemented method of claim 10, further comprising: Pre-train a neural classifier model on multiple unsupervised source code samples.

12. The computer-implemented method of claim 10, wherein the vulnerability classification comprises: At least one Common Vulnerabilities and Exposures (CVE) vulnerability and / or at least one Common Weakness Enumeration (CWE) vulnerability.

13. The computer-implemented method of claim 11 , further comprising: Each of the embeddings of the non-vulnerable source code samples in the non-vulnerable embedding database is generated using the pre-trained neural classifier model.

14. The computer-implemented method of claim 10, further comprising: regenerating the embeddings of the non-vulnerable source code samples and the vulnerable source code samples using the fine-tuned neural classifier model; reselecting a non-vulnerable source code sample from among the plurality of non-vulnerable source code samples having the regenerated embedding similar to the regenerated embedding of each of the network security vulnerability source code samples; as well as The fine-tuned classifier model is re-adjusted with the re-selected non-vulnerable source code samples and the vulnerable source code samples with similar re-generated embeddings.

15. The computer-implemented method of claim 10, wherein the pre-trained classifier model is a Neural Encoder Transformer with Attention.

Images