Source code vulnerability detection and repair through machine learning
A neural classifier model is used to detect cybersecurity vulnerabilities in the source code predicted by a deep learning code generation model having been trained on source code possibly containing security bugs. Upon the classifier model classifying a given source code snippet as likely containing a cybersecurity vulnerability, a proposed repair for the cybersecurity vulnerability is predicted from a neural decoder transformer model having been trained on non-vulnerable source code. The neural decoder transformer model is used to predict source code that repairs the cybersecurity vulnerability given the source code classified with a cybersecurity vulnerability.
1 . A system comprising:
a processor; and
a memory that stores a program configured to be executed by the processor, wherein the program comprises instructions that perform acts to:
obtain a source code snippet;
identify through a neural classifier that the source code snippet comprises a cybersecurity vulnerability; and
generate repair source code that repairs the cybersecurity vulnerability in the source code snippet, wherein the repair source code is generated by a beam search component coupled to a decoder neural model, wherein the beam search component generates partial repair code sequences of tokens iteratively at each of a plurality of timesteps, wherein the beam search invokes the neural decoder model, given the source code snippet and the cybersecurity vulnerability, to generate at each time step a probability distribution to identify select tokens to be the next token in a partial repair code sequence, wherein the beam search expands each partial repair code sequence from the select tokens identified by the probability distribution output, wherein the beam search ends when a termination token appears as the most probable next token for a select partial repair code sequence which is then output as a sequence of tokens representing the repair source code.
2 . The system of claim 1 , wherein the source code snippet comprising the cybersecurity vulnerability is generated by a machine learning model.
3 . The system of claim 1 , wherein the program comprises instructions that perform acts to:
extract the source code snippet comprising the cybersecurity vulnerability from a pull request, wherein the source code snippet comprising the cybersecurity vulnerability includes changes to a code base.
4 . The system of claim 1 , wherein the cybersecurity vulnerability comprises a Common Vulnerability and Exposures (CVE) vulnerability.
5 . The system of claim 1 , wherein the cybersecurity vulnerability comprises a Common Weakness Enumeration (CWE) weakness.
6 . The system of claim 1 , wherein the neural classifier is trained on a plurality of source code with select ones of a plurality of cybersecurity vulnerabilities and a plurality of source code without a cybersecurity vulnerability.
7 . A hardware storage device having stored thereon computer executable instructions that are structured to be executable by a processor of a computing device to thereby cause the computing device to perform actions that:
obtain a machine-generated source code snippet from a source code edit session;
identify through a neural classifier that the machine-generated source code snippet comprises a cybersecurity vulnerability; and
generate repair source code that repairs the cybersecurity vulnerability in the machine-generated source code snippet, wherein the repair source code is generated by a beam search component interacting with a decoder neural model, wherein the beam search component generates partial repair code sequences of tokens iteratively at each of a plurality of timesteps, wherein the beam search invokes the neural decoder model, given the machine-generated source code snippet and the cybersecurity vulnerability, to generate at each time step a probability distribution to identify select tokens to be the next token in a partial repair code sequence, wherein the beam search expands each partial repair code sequence from the select tokens identified by the probability distribution output, wherein the beam search ends when a termination token appears as the most probable next token for a select partial repair code sequence which is then output as a sequence of tokens representing the repair source code that repairs the cybersecurity vulnerability in the machine-generated source code snippet.
8 . The hardware storage device of claim 7 having stored thereon computer executable instructions that are structured to be executable by a processor of a computing device to thereby cause the computing device to perform actions that:
output the repair source code in the source code edit session.
9 . The hardware storage device of claim 7 , wherein the cybersecurity vulnerability comprises a Common Vulnerability and Exposures (CVE) vulnerability.
10 . The hardware storage device of claim 7 , wherein the cybersecurity vulnerability comprises a Common Weakness Enumeration (CWE) weakness.
11 . The hardware storage device of claim 7 , wherein the neural classifier is trained on a plurality of source code with select ones of a plurality of cybersecurity vulnerabilities and a plurality of source code without a cybersecurity vulnerability.
12 . A computer-implemented method, comprising:
obtaining a pull request from a source code repository, wherein the pull request comprises a modified source code snippet;
identifying, through a neural classifier model, that the modified source code snippet includes a cybersecurity vulnerability; and
generating repair source code that repairs the modified source code snippet, wherein the repair source code is generated by a repair engine comprising a beam search component and a decoder neural model, wherein the beam search component generates partial repair code sequences of tokens iteratively at each of a plurality of timesteps, wherein the beam search invokes the neural decoder model, given the modified source code snippet and the cybersecurity vulnerability, to generate at each time step a probability distribution to identify select tokens to be the next token in a partial repair code sequence, wherein the beam search expands each partial repair code sequence from the select tokens identified by the probability distribution output, wherein the beam search ends when a termination token appears as the most probable next token for a select partial repair code sequence which is then output as a sequence of tokens representing the repair source code that repairs the cybersecurity vulnerability in the modified source code snippet.
13 . The computer-implemented method of claim 12 , further comprising:
providing the repair source code to the source code repository.
14 . The computer-implemented method of claim 12 , wherein the cybersecurity vulnerability comprises a Common Weakness Enumeration (CWE) weakness.
15 . The computer-implemented method of claim 12 , wherein the cybersecurity vulnerability comprises a Common Vulnerability and Exposures (CVE) vulnerability.