Code Vulnerability Detection Using Function Change Logs

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing clone-based and AI-based methods for detecting vulnerabilities in computer code have high false positive rates due to their inability to distinguish between vulnerable and patched code sections, particularly when patches make minimal changes and are not programming language agnostic.

Innovation Solution

A method that calculates a function change log of a code section, comparing it to a fix change log to determine if a patch has been applied, using a subsequence matching method to reduce false positives, and incorporates AI for code similarity detection.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If clone-based approaches are used to detect vulnerabilities by searching for similar code sections, then vulnerability detection coverage is improved, but false positive rate increases due to inability to distinguish between vulnerable and patched code

Engineering Contradiction:

Improvevulnerability detection coverageVSAvoidfalse positive rate

Core Design Contradiction:

ReliabilityVSMeasurement precision

Solution Approach 1:

The system performs preliminary actions by calculating change logs that record historical modifications to code sections before vulnerability detection. These change logs capture the evolution of code from vulnerable states to patched states, enabling the system to distinguish between actual vulnerabilities and patched code in advance of final detection.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system incorporates feedback mechanisms by comparing detected vulnerability candidates against their change logs to verify whether patches have been applied. This feedback loop allows the system to adjust its detection results based on historical code evolution information, reducing false positives while maintaining detection coverage.

Inventive Principle:

Principle #23Feedback

2Productivity

If traditional clone-based detection methods are used, then detection speed is maintained, but accuracy deteriorates due to minimal code changes in patches being undetectable

Engineering Contradiction:

Improvedetection speedVSAvoiddetection accuracy

Core Design Contradiction:

ProductivityVSMeasurement precision

Solution Approach 1:

The system calculates change logs in advance that document all historical modifications to code sections. This preliminary recording of code evolution enables fast comparison during vulnerability detection without requiring real-time analysis of code semantics, maintaining detection speed while improving accuracy through historical context.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The change log serves as an intermediary data structure between the original code and the vulnerability detection process. It mediates the comparison by providing a structured history of code changes, allowing the system to efficiently determine whether minimal patch changes have been applied without re-analyzing the entire codebase.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Reliability

If AI-based methods are used for vulnerability detection, then detection capability is improved, but false positive rate increases due to language-specific limitations

Engineering Contradiction:

Improvedetection capabilityVSAvoidprogramming language agnosticism

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The system achieves universality by using change logs that can be calculated and compared across different programming languages without requiring language-specific AI models. The change log format and comparison mechanism are language-agnostic, allowing the same system to detect vulnerabilities in multiple programming languages while maintaining accuracy through historical change analysis.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS20260030366A1Methods, systems, apparatuses, and computer-readable media for detecting vulnerabilities in computer code

Publication Date: 2026.01.29 HUAWEI TECH CO LTD

AI summary

A method, system, apparatus, and computer-readable storage medium for detecting vulnerabilities in computer code. A computer processor calculates a function change log of a section of the computer code, the function change log comprising at least one intermediate change between a first version of the section of computer code and a second version of the section of computer code, the section of the computer code being similar to a computer-code vulnerability, and the first version is a version prior to the second version. The computer processor determines whether the section of the computer code comprises the computer-code vulnerability based on a similarity between the function change log and a fix change log, the fix change log comprising at least one code change for fixing the computer-code vulnerability.