Application risk identification and remediation utilizing a language model

1 . A system comprising:

a computer-readable memory configured to store a plurality of code-specific large language models (LLM) capable of interpreting software code, wherein each code-specific LLM of the plurality of code-specific LLMs is configured to identify a respective risk type of a plurality of risk types; and

one or more processors configured to execute computer-executable instructions to at least:

receive a request to perform a risk analysis of an application under test, wherein the request includes an identity of the application under test;

access software code corresponding to the application under test from a code repository;

determine an input size limit of the code-specific LLM;

divide the software code into a plurality of code segments based at least in part on the input size limit, wherein a size of each code segment of the plurality of code segments satisfies the input size limit of the code-specific LLM;

generate a plurality of code risk values by at least evaluating, using at least two code-specific LLMs of the plurality of code-specific LLMs, each code segment of the plurality of code segments to obtain a code risk value for the code segment of the plurality of code segments, wherein a first code risk value of the plurality of code risk values is associated with a first risk type, wherein a second code risk value of the plurality of code risk values is associated with a second risk type, and wherein the first risk type is different from the second risk type;

determine an application risk value of the application under test based at least in part on the plurality of code risk values;

based at least in part on the application risk value, determine a remedial action; and

execute the remedial action.

2 . The system of claim 1 , wherein the application risk value is determined based at least in part on an identified sensitivity of data.

3 . The system of claim 1 , wherein sensitive data comprises at least one of: personally identifiable information, financial information, data stored in a secure data storage location, information associated with an effect on human safety, or a private cryptographic key.

4 . The system of claim 1 , wherein a code risk value of the code segment is determined by the code-specific LLM based at least in part on a determination of whether an authentication process is performed by the code segment.

5 . The system of claim 1 , wherein the one or more processors are further configured to execute the computer-executable instructions to at least:

access an assigned risk value of the application under test; and

determine that the application risk value does not match the assigned risk value by at least comparing the application risk value to the assigned risk value,

wherein the remedial action comprises generating an alert indicating that the assigned risk value does not match the application risk value.

6 . The system of claim 1 , wherein the one or more processors are further configured to execute the computer-executable instructions to at least identify a code segment of the plurality of code segments for additional review based at least in part on a code risk value assigned to the code segment, wherein the remedial action comprises at least transmitting a request for additional review of the code segment of the plurality of code segments to a reviewer.

7 . A method comprising:

by a hardware processor of a computing device,

receiving a request to perform a risk analysis of an application;

accessing software code corresponding to the application from a code repository;

generating an application risk value for the software code by at least evaluating the software code using at least two machine learning models of a plurality of machine learning models each configured to identify a respective risk type of a plurality of risk types, wherein generating the application risk value comprises evaluating the software code using a first machine learning model of the plurality of machine learning models configured to determine a first code risk for code of a first risk type of the plurality of risk types and a second machine learning model of the plurality of machine learning models configured to determine a second code risk for code of a second risk type of the plurality of risk types different from the first risk type, wherein the first machine learning model is different from the second machine learning model;

based at least in part on the application risk value, determining a remedial action; and

executing the remedial action.

8 . The method of claim 7 , wherein the first machine learning model has an input size limit and wherein generating the application risk value further comprises:

dividing the software code into a plurality of code segments based at least in part on the input size limit, wherein a size of each code segment of the plurality of code segments satisfies the input size limit of the first machine learning model;

generating a plurality of code risk values by applying each code segment to the first machine learning model to obtain a code risk value for the code segment; and

determining the application risk value based at least in part on the plurality of code risk values and the second code risk.

9 . The method of claim 8 , wherein determining the application risk value based at least in part on the plurality of code risk values comprises determining whether a number of code risk values indicating a high risk satisfies a threshold value.

10 . The method of claim 7 , wherein the remedial action is determined based at least in part on the application risk value, and wherein executing the remedial action comprises replacing a portion of the software code identified as having a high risk value with an alternative code segment having a lower risk value.

11 . The method of claim 7 , wherein the remedial action is determined based at least in part on the application risk value, and wherein executing the remedial action comprises preventing publication of the software code to prevent further use of the software code.

12 . The method of claim 7 , wherein the remedial action is determined based at least in part on the application risk value, and wherein executing the remedial action comprises at least one of: publishing the software code, providing an alert that the application risk value is different from a stored application risk value, or requesting an additional vulnerability scan of the software code from a vulnerability analysis system.

13 . The method of claim 7 , wherein the first risk type and the second risk type each correspond to a risk associated with one or more of: a vulnerability, unauthorized data access, or unsecure data storage.

14 . The method of claim 7 , wherein the first code risk corresponds to the first risk type, wherein the second code risk corresponds to the second risk type, and wherein the first risk type and the second risk type differ.

15 . A system comprising:

a computer-readable memory; and

one or more processors configured to execute computer-executable instructions to at least:

access software code corresponding to an application from a code repository;

generate an application risk value for the software code by at least evaluating the software code using at least two machine learning models of a plurality of machine learning models each configured to identify a respective risk type of a plurality of risk types, wherein generating the application risk value comprises evaluating the software code using a first machine learning model of the plurality of machine learning models configured to determine a first code risk for code of a first risk type of the plurality of risk types and a second machine learning model of the plurality of machine learning models configured to determine a second code risk for the code of a second risk type of the plurality of risk types different from the first risk type, wherein the first machine learning model is different from the second machine learning model;

determine that the application risk value exceeds a threshold; and

in response to determining that the application risk value exceeds the threshold, execute a remedial action.

16 . The system of claim 15 , wherein the first machine learning model is a code-specific large language model (LLM).

17 . The system of claim 16 , wherein the code-specific LLM is further configured to generate a reasoning for the application risk value determined for the software code, and wherein the remedial action comprises providing the reasoning for presentation via a user interface to a user.

18 . The system of claim 16 , wherein the application risk value is determined based at least in part on the LLM identifying a new vulnerability in the software code based at least in part on a threshold similarity between a code segment and a known vulnerability.

19 . The system of claim 15 , wherein the remedial action comprises providing a portion of the software code associated with the determination of the application risk value to a requesting system.

20 . The system of claim 15 , wherein the one or more processors are further configured to execute the computer-executable instructions to at least compare the application risk value to a known application risk value to generate a comparison result, and wherein the remedial action comprises providing the comparison result for presentation via a user interface to a user.