Source Code Vulnerability Detection via Program Slicing and ML
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing vulnerability scanning solutions are inefficient in detecting and locating precise vulnerabilities in source code, often resulting in high false alarm rates and requiring extensive computational resources, as they lack the ability to perform multiclass vulnerability classification and leverage minimal semantic information.
Innovation Solution
A predictive machine learning model is trained using a training dataset generated by program slicing and static analysis, which maps source code to program slices and identifies vulnerabilities based on syntax and semantic features, enabling precise vulnerability detection and reducing the need for extensive training data and computational resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional vulnerability scanning solutions are used, then comprehensive code analysis is performed, but false alarm rates increase and computational resources are excessively consumed
Solution Approach 1:
The patent applies segmentation by dividing the source code into program slices based on program slicing criteria. Instead of analyzing the entire codebase, the system extracts and analyzes only relevant code segments that contain potential vulnerabilities. This segmentation reduces the volume of code requiring comprehensive analysis, thereby lowering computational resource consumption while maintaining detection accuracy.
Solution Approach 2:
The patent extracts minimal semantic information and syntax features from the source code that are most relevant to vulnerability detection. By taking out only the essential code characteristics needed for identification rather than performing exhaustive analysis of all code elements, the system reduces computational overhead while preserving detection precision.
2Measurement precision
If traditional vulnerability scanning solutions are used, then code analysis is performed, but false alarm rates increase
Solution Approach 1:
The patent applies local quality by training the machine learning model on extracted syntax features and minimal semantic information specific to vulnerability patterns. The model learns to identify local code characteristics that are indicative of vulnerabilities, enabling precise detection without the false alarms that result from overly broad or generic scanning approaches.
Solution Approach 2:
The patent changes the parameters of analysis by focusing on specific syntax features and semantic characteristics rather than performing comprehensive semantic analysis. This parameter change allows the system to maintain high detection accuracy while reducing false alarms through targeted feature extraction and machine learning-based classification.
3Measurement precision
If comprehensive semantic analysis is performed, then vulnerability detection capability is enhanced, but training data requirements and computational resources increase
Solution Approach 1:
The patent extracts only the essential syntax features and minimal semantic information needed for vulnerability detection from the source code. This extraction approach reduces the volume of training data required, as the machine learning model is trained on focused, relevant features rather than requiring comprehensive semantic analysis of large datasets.
Solution Approach 2:
The patent changes the analysis parameters by using syntax-based features and minimal semantic information instead of comprehensive semantic analysis. This parameter change enables effective vulnerability detection with reduced training data requirements, as the model learns from targeted feature patterns rather than requiring extensive full-semantic training corpora.
Data Source
AI summary
Various embodiments of the present disclosure provide methods, apparatus, systems, computing devices, computing entities, and/or the like for detecting and locating vulnerabilities in source code. The method comprises receiving one or more source code files, matching source code from the one or more source code files to one or more program slices by parsing the source code and mapping one or more portions of the source code to the one or more program slices, wherein each of the one or more program slices comprises one or more program statements associated with one or more vulnerabilities, and generating, using a predictive machine learning model, a vulnerability prediction for each of the one or more source code files, the vulnerability prediction comprising one or more locations of vulnerable code in the source code based on the matching and a vulnerability class associated with each location of vulnerable code.