Neural Code Change Representation Learning for Vulnerability Fix Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a need for a neural network that can detect vulnerability fixes in computer code changes, particularly in open source software, to prevent malicious exploitation during the time gap between fixing vulnerabilities and their public disclosure, and existing methods face challenges due to insufficient training data and reliance on supervised learning.
Innovation Solution
A neural network is trained using contrastive learning with data augmentation techniques, dividing code into function slices and generating augmented samples to identify vulnerability fixes unsupervisedly, leveraging control and data flow graphs and CWE categories to enhance training data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If supervised learning is used to train the neural network to detect vulnerability fixes, then the model can achieve accurate detection, but the lack of sufficient labeled training data limits the effectiveness
Solution Approach 1:
The patent creates synthetic training data by copying and modifying existing code patches. It generates augmented patches by inserting, deleting, or modifying code segments while preserving the vulnerability fix semantics. This synthetic data copying approach enables the model to train on sufficient data without requiring actual labeled vulnerability fix data, resolving the data scarcity problem while maintaining detection accuracy.
Solution Approach 2:
The system uses itself to generate training data. The neural network architecture includes components that automatically generate synthetic training samples from existing code patches without external intervention. This self-service data generation capability allows the model to create its own training material, eliminating the dependency on manually labeled datasets and enabling accurate detection despite initial data limitations.
2Measurement precision
If code is divided into function slices and augmented samples are generated to increase training data, then the neural network can learn better representations, but the device complexity increases
Solution Approach 1:
The patent segments code patches into function slices by dividing the code into meaningful functional units. This segmentation allows the system to process and generate augmented samples from manageable code portions rather than entire files. By breaking down the code structure into slices, the system reduces processing complexity while maintaining the ability to learn accurate representations of vulnerability fixes through contrastive learning on these segmented samples.
Data Source
AI summary
There is described a method and a computer-readable medium for training a neural network. A section of computer code is divided into a plurality of computer code parts. A first change sample is generated comprising a first original segment of computer code and a first modified segment of computer code, the first change sample comprising at least one of the plurality of computer code parts. A second change sample is generated comprising a second original segment of computer code and a second modified segment of computer code. A loss function is calculated based on the first change sample and the second change sample. The neural network is trained by minimizing the loss function.