Systems and methods for triaging software vulnerabilities
Systems and methods are provided for the classification of identified security vulnerabilities in software applications, and their automated triage based on machine learning. The disclosed system may generate a report listing detected potential vulnerability issues, and extract features from the report for each potential vulnerability issue. The system may receive policy data and business rules, and compare the extracted features relative to such data and rules. The system may determine a token based on the source code of a potential vulnerability issue, and a vector based on the extracted features of a potential vulnerability issue and based on the token. The system may select a machine learning modelling method and/or an automated triaging method based on the vector, and determine a vulnerability accuracy score based on the vector using the selected method.
1. A system for managing software, comprising:
a memory to store executable instructions; and,
a processor adapted to access the memory, the processor further adapted to execute the executable instructions stored in the memory to:
obtain an electronic document listing potential vulnerability issues of a software product based on a scan of source code;
extract features from the electronic document for each potential vulnerability issue;
receive policy data or business rules;
compare the extracted features relative to the policy data or business rules;
determine a token based on the scanned source code corresponding to at least one of the potential vulnerability issues;
determine a vector based on the extracted features;
select one of a plurality of vulnerability-scoring methods based on the vector, the vulnerability-scoring methods selected from a group consisting of machine learning modelling methods and automated triaging methods; and,
determine a vulnerability accuracy score based on the vector using the selected vulnerability-scoring method.
2. The system of claim 1 , wherein the processor is further adapted to:
scan source code of the software product to detect the potential vulnerability issues; and,
generate the electronic document based on the detected potential vulnerability issues.
3. The system of claim 1 , wherein the vector is based on the token.
4. The system of claim 1 , wherein the processor is further adapted to:
display the vulnerability accuracy score to a user.
5. The system of claim 1 , wherein the machine learning modelling methods comprise random forest machine learning models.
6. A system for managing software, comprising:
a memory to store executable instructions; and,
a processor adapted to access the memory, the processor further adapted to execute the executable instructions stored in the memory to:
obtain an electronic document listing potential vulnerability issues of a software product;
extract features from the electronic document for each potential vulnerability issue;
determine a vector based on the extracted features;
select one of a plurality of vulnerability-scoring methods based on the vector, the vulnerability-scoring methods selected from a group consisting of machine learning modelling methods and automated triaging methods; and,
determine a vulnerability accuracy score based on the vector using the selected vulnerability-scoring method,
wherein the automated triaging methods comprise blanket-rules automated triaging methods and programming-rules automated triaging methods.
7. A method for managing software, comprising the steps of:
obtaining an electronic document listing potential vulnerability issues of a software product based on a scan of source code;
extracting features from the electronic document for each potential vulnerability issue;
receiving policy data or business rules;
comparing the extracted features relative to the policy data or business rules;
determining a token based on the scanned source code corresponding to at least one of the potential vulnerability issues;
determining a vector based on the extracted features;
selecting one of a plurality of vulnerability-scoring methods based on the vector, the vulnerability-scoring methods selected from a group consisting of machine learning modelling methods and automated triaging methods; and,
determining a vulnerability accuracy score based on the vector using the selected vulnerability-scoring method.
8. The method of claim 7 , further comprising the steps of:
scanning source code of the software product to detect the potential vulnerability issues; and,
generating the electronic document based on the detected potential vulnerability issues.
9. The method of claim 7 , wherein the vector is based on the token.
10. The method of claim 7 , further comprising the step of:
displaying the vulnerability accuracy score to a user.
11. The method of claim 7 , wherein the machine learning modelling methods comprise random forest machine learning models.
12. A method for managing software, comprising the steps of:
obtaining an electronic document listing potential vulnerability issues of a software product;
extracting features from the electronic document for each potential vulnerability issue;
determining a vector based on the extracted features;
selecting one of a plurality of vulnerability-scoring methods based on the vector, the vulnerability-scoring methods selected from a group consisting of machine learning modelling methods and automated triaging methods; and
determining a vulnerability accuracy score based on the vector using the selected vulnerability-scoring method, wherein the plurality of automated triaging methods comprise blanket-rules automated triaging methods and programming-rules automated triaging methods.
13. A non-transitory computer-readable medium including instructions configured to be executed by a processor, wherein the executed instructions are adapted to cause the processor to:
obtain an electronic document listing potential vulnerability issues of a software product based on a scan of source code;
extract features from the electronic document for each potential vulnerability issue;
receive policy data or business rules;
compare the extracted features relative to the policy data or business rules;
determine a token based on the scanned source code corresponding to at least one of the potential vulnerability issues;
determine a vector based on the extracted features;
select one of a plurality of vulnerability-scoring methods based on the vector, the vulnerability-scoring methods selected from a group consisting of machine learning modelling methods and automated triaging methods; and,
determine a vulnerability accuracy score based on the vector using the selected vulnerability-scoring method.
14. The computer-readable medium of claim 13 , further comprising executed instructions adapted to cause the processor to:
scan source code of the software product to detect the potential vulnerability issues; and,
generate the electronic document based on the detected potential vulnerability issues.
15. The computer-readable medium of claim 13 , wherein the vector is based on the token.
16. The computer-readable medium of claim 13 , further comprising executed instructions adapted to cause the processor to:
display the vulnerability accuracy score to a user.
17. A non-transitory computer-readable medium including instructions configured to be executed by a processor, wherein the executed instructions are adapted to cause the processor to:
obtain an electronic document listing potential vulnerability issues of a software product;
extract features from the electronic document for each potential vulnerability issue;
determine a vector based on the extracted features;
select one of a plurality of vulnerability-scoring methods based on the vector, the vulnerability-scoring methods selected from a group consisting of machine learning modelling methods and automated triaging methods; and
determine a vulnerability accuracy score based on the vector using the selected vulnerability-scoring method, wherein the machine learning modelling methods comprise random forest machine learning models, and wherein the automated triaging methods comprise blanket-rules automated triaging methods and programming-rules automated triaging methods.