LLM-Based Semantic Code Clustering for Fewer False Alarms
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity solutions face challenges in accurately clustering source code variations due to syntax-based analysis shortcomings, leading to a high volume of false alarms and labor-intensive manual reviews, which strain resources and customer satisfaction.
Innovation Solution
A hybrid clustering technique using multiple paths, including semantic, agnostic, label informed, and task/label informed paths, to analyze source code syntax and semantics, identify discrepant clusters, and adjust clustering paths for improved accuracy and efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If syntax-based analysis is used for clustering source code, then the analysis process is simple and fast, but the accuracy is low leading to high false alarms
Solution Approach 1:
The patent divides the source code analysis into multiple independent clustering paths: syntax-based clustering path, semantic clustering path, label-informed clustering path, and task-informed clustering path. Each path processes code segments differently and produces separate cluster results, which are then merged and validated. This segmentation allows the system to maintain simplicity in individual paths while achieving high accuracy through combined results.
Solution Approach 2:
The patent merges results from multiple clustering paths by creating a unified cluster structure that integrates syntax-based clusters, semantic clusters, label-informed clusters, and task-informed clusters. The merging process resolves conflicts between different clustering approaches and produces a final cluster assignment that leverages the strengths of each method, thereby improving overall accuracy without excessive complexity in any single path.
2Productivity
If manual review of code variations is performed, then accuracy can be verified, but labor and time consumption increase significantly
Solution Approach 1:
The patent implements self-service through automated cluster validation and discrepant plot generation. The system automatically evaluates cluster quality by comparing cluster plots across different paths, identifies discrepant clusters that require attention, and generates explanations for cluster assignments. This automation allows the system to verify its own accuracy and reduce the need for manual intervention, significantly improving review efficiency while reducing time loss.
3Reliability
If multiple clustering paths are implemented, then clustering accuracy improves, but system complexity increases
Solution Approach 1:
The patent incorporates feedback mechanisms where cluster plots from different paths are compared to identify discrepant clusters. The system uses this feedback to adjust and refine cluster assignments, generating explanations for why certain code variations are grouped together. This feedback loop ensures reliable clustering by continuously validating and improving results, while the modular structure keeps system complexity manageable through clear separation of concerns between different clustering paths.
Data Source
AI summary
An approach is provided that provides a plurality of source code samples to an artificial intelligence model (AIM) trained to describe source code based on performing semantic analysis on the source code. The approach produces, using the AIM, a plurality of semantic descriptions that describe the plurality of source code samples. Then, the approach converts the plurality of semantic descriptions into a plurality of semantic embeddings. In turn, the approach creates a plurality of clusters from the plurality of semantic embeddings, wherein each one of the plurality of clusters corresponds to two or more of the plurality of source code samples.