Code Vulnerability Detection Using Historical Patch Diffs

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Clone-based approaches for detecting vulnerabilities in computer code have a high false positive rate due to minimal differences between vulnerable and patched code sections, and existing AI-based and function matching methods are not programming language agnostic.

Innovation Solution

A method that calculates changes between a current code section and its historical versions, comparing these changes to the changes made in fixing a known vulnerability, to distinguish between vulnerable and patched code sections.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If clone-based approaches are used to detect vulnerabilities, then detection coverage is improved, but false positive rate increases

Engineering Contradiction:

Improvevulnerability detection accuracyVSAvoidfalse positive rate

Core Design Contradiction:

ReliabilityVSMeasurement precision

Solution Approach 1:

The system performs preliminary actions by calculating diffs between historical versions of the code before final vulnerability determination. It computes the diff between the current code section and historical versions, then compares this diff against the known vulnerability patch diff to determine whether the vulnerability has been patched, thereby reducing false positives before reporting results.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system uses feedback by comparing the calculated diff against the known vulnerability patch diff. This feedback mechanism allows the system to determine whether the detected similarity is due to the vulnerability being present or due to the code having been patched, thereby correcting false positive detections.

Inventive Principle:

Principle #23Feedback

2Productivity

If minimal changes are made to code to fix vulnerabilities, then patch efficiency is improved, but code similarity between vulnerable and patched versions increases

Engineering Contradiction:

Improvepatch efficiencyVSAvoidcode section distinguishability

Core Design Contradiction:

ProductivityVSMeasurement precision

Solution Approach 1:

The system extracts the essential information needed for vulnerability detection by calculating the diff between historical versions and comparing it against the known patch diff. This extraction approach focuses only on the changes made in the patch rather than analyzing the entire code section, thereby maintaining the ability to distinguish vulnerable from patched code even when patches are minimal.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The system changes the parameter of comparison from raw code similarity to diff similarity. Instead of comparing the entire code sections directly (which would be misleading when patches are minimal), it compares the diffs between versions, transforming the comparison to one that captures the essence of the patch changes rather than overall code similarity.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS20250348597A1Methods, systems, apparatuses, and computer-readable media for detecting vulnerabilities in computer code

Publication Date: 2025.11.13 HUAWEI TECH CO LTD

AI summary

A method, system, apparatus, and computer-readable storage medium for detecting vulnerabilities in computer code. A computer processor calculates a first change between a first version of a section of the computer code and a second version of the section of the computer code, the section of the computer code being similar to a computer-code vulnerability, and the second version is a version prior to the first version. The computer processor determines whether the section of the computer code comprises the computer-code vulnerability based on a similarity between the first change and a second change, the second change being a change between the computer-code vulnerability and a fix for the computer-code vulnerability.