System and method for prioritizing and ranking static analysis results using machine learning

1. A method comprising:

obtaining at least one program slice embedding vector and at least one register vector that are generated based on results from a static analysis tool, the at least one register vector corresponding to the at least one program slice embedding vector;

using a machine learning model to generate, from the at least one program slice embedding vector and the at least one register vector, at least one probability rating associated with a vulnerability; and

reporting the at least one probability rating for use by the static analysis tool.

2. The method of claim 1 , wherein:

the results from the static analysis tool are generated based on analysis of a binary by the static analysis tool; and

the at least one probability rating indicates a probability of the vulnerability existing in the binary.

3. The method of claim 2 , wherein each of the at least one program slice embedding vector is generated from a program slice representing portions of the binary that correspond to the vulnerability.

4. The method of claim 2 , wherein each of the at least one register vector indicates a CPU register that corresponds to the vulnerability.

5. The method of claim 1 , wherein:

the at least one probability rating comprises multiple probability ratings, and

the method further comprises ranking or aggregating the multiple probability ratings.

6. The method of claim 1 , wherein the machine learning model is trained in an iterative process using training data comprising a plurality of program slice embedding vectors, a plurality of register vectors, and a plurality of labels.

7. The method of claim 6 , wherein:

each of the plurality of register vectors in the training data indicates a CPU register; and

each of the plurality of labels in the training data identifies a register type of a corresponding one of the plurality of register vectors.

8. A system comprising:

at least one memory configured to store instructions; and

at least one processor coupled to the at least one memory and configured when executing the instructions to:

obtain at least one program slice embedding vector and at least one register vector that are generated based on results from a static analysis tool, the at least one register vector corresponding to the at least one program slice embedding vector;

use a machine learning model to generate, from the at least one program slice embedding vector and the at least one register vector, at least one probability rating associated with a vulnerability; and

report the at least one probability rating for use by the static analysis tool.

9. The system of claim 8 , wherein:

the results from the static analysis tool are generated based on analysis of a binary by the static analysis tool; and

the at least one probability rating indicates a probability of the vulnerability existing in the binary.

10. The system of claim 9 , wherein each of the at least one program slice embedding vector is generated from a program slice representing portions of the binary that correspond to the vulnerability.

11. The system of claim 9 , wherein each of the at least one register vector indicates a CPU register that corresponds to the vulnerability.

12. The system of claim 8 , wherein:

the at least one probability rating comprises multiple probability ratings, and

the at least one processor is further configured to rank or aggregate the multiple probability ratings.

13. The system of claim 8 , wherein the machine learning model is trained in an iterative process using training data comprising a plurality of program slice embedding vectors, a plurality of register vectors, and a plurality of labels.

14. The system of claim 13 , wherein:

each of the plurality of register vectors in the training data indicates a CPU register; and

each of the plurality of labels in the training data identifies a register type of a corresponding one of the plurality of register vectors.

15. A non-transitory computer readable medium containing instructions that when executed cause at least one processor to:

obtain at least one program slice embedding vector and at least one register vector that are generated based on results from a static analysis tool, the at least one register vector corresponding to the at least one program slice embedding vector;

use a machine learning model to generate, from the at least one program slice embedding vector and the at least one register vector, at least one probability rating associated with a vulnerability; and

report the at least one probability rating for use by the static analysis tool.

16. The non-transitory computer readable medium of claim 15 , wherein:

the results from the static analysis tool are generated based on analysis of a binary by the static analysis tool; and

the at least one probability rating indicates a probability of the vulnerability existing in the binary.

17. The non-transitory computer readable medium of claim 16 , wherein each of the at least one program slice embedding vector is generated from a program slice representing portions of the binary that correspond to the vulnerability.

18. The non-transitory computer readable medium of claim 16 , wherein each of the at least one register vector indicates a CPU register that corresponds to the vulnerability.

19. The non-transitory computer readable medium of claim 15 , wherein:

the at least one probability rating comprises multiple probability ratings, and

the instructions further cause the at least one processor to rank or aggregate the multiple probability ratings.

20. The non-transitory computer readable medium of claim 15 , wherein the machine learning model is trained in an iterative process using training data comprising a plurality of program slice embedding vectors, a plurality of register vectors, and a plurality of labels.