Method, system, and computer program product for automatically mitigating vulnerabilities in source code

1. A method for training a model that automatically evaluates a generated vulnerability remediation in a source code of an application comprising:

obtaining training input data, wherein the training input data comprises a plurality of input features, each of the input features comprises a training vulnerability and a training remediation of the training vulnerability;

obtaining training output data, wherein the training output data comprises a plurality of output predictions, each of the output predictions comprises a training validation associated with the training vulnerability and the training remediation of the corresponding input feature; and

training the model based on the training input data and the training output data.

2. The method according to claim 1 , wherein before the step of obtaining the training input data, the method further comprises:

building a path graph according to a first source code, wherein the path graph comprises a plurality of paths, and wherein each of the paths comprises a plurality of nodes;

identifying a plurality of tainted paths from the paths, wherein each of the tainted paths corresponds to a vulnerability;

locating a target node among the tainted paths;

suggesting an instant-fix call for mitigating at least one vulnerability in the target node; and

generating a first input feature of the input features and a first output prediction of the output predictions according to the instant-fix call.

3. The method according to claim 2 , wherein the training vulnerability of the first input feature is associated with the at least one vulnerability in the target node, and the wherein the training remediation of the first input feature is associated with the instant-fix call.

4. The method according to claim 2 , wherein the training validation of the first output prediction is associated with a determination on whether the instant-fix call is able to mitigate the at least one vulnerability in the target node.

5. The method according to claim 2 , wherein the training validation of the first output prediction is a manual label of a correctness of the target node and a correctness of the instant-fix call.

6. The method according to claim 2 , wherein the training validation of the first output prediction is an automatic label of a correctness of the target node and a correctness of the instant-fix call based on whether the first source code is amended according to the instant-fix call.

7. The method according to claim 2 , wherein the training validation of the first output prediction is an automatic label of a correctness of the target node and a correctness of the instant-fix call based on whether the automatically generated instant-fix call or a revision of the instant-fix call is accepted to amend the source code.

8. The method according to claim 2 , wherein the training validation of the first output prediction is an automatic label of a correctness of the target node and a correctness of the instant-fix call based on history data of the instant-fix call.

9. The method according to claim 2 , wherein each of the input features further comprises an organization or an industry of a customer corresponding to the first input feature and the first output prediction.

10. The method according to claim 2 , wherein each of the input features further comprises at least one of a technology stack and a risk profile of a customer corresponding to the first input feature and the first output prediction.

11. The method according to claim 2 , wherein each of the input features further comprises metadata generated by a node selection algorithm.

12. The method according to claim 2 , wherein each of the output predictions further comprises a confidence score of the instant-fix call.

13. The method according to claim 2 , wherein each of the output predictions further comprises a correctness of sharing the same instant-fix call with another node.

14. The method according to claim 2 , wherein each of the output predictions further comprises a false positive of the at least one vulnerability.

15. The method according to claim 14 , wherein the false positive of the at least one vulnerability is an automatic label based on a user interaction on the at least one vulnerability.

16. The method according to claim 1 further comprising:

receiving new training input data and new training output data from a plurality of client computers; and

updating the trained model based on the new training input data and the new training output data.

17. A computer system comprising:

a memory;

a processor, coupled to the memory and configured to:

obtain training input data, wherein the training input data comprises a plurality of input features, each of the input features comprises a training vulnerability and a training remediation of the training vulnerability;

obtain training output data, wherein the training output data comprises a plurality of output predictions, each of the output predictions comprises a training validation associated with the training vulnerability and the training remediation of the corresponding input feature; and

train the model based on the training input data and the training output data.

18. A non-transitory computer-readable medium comprising a plurality of program instructions, which when executed by a computer system, cause the computer system to execute steps of:

obtaining training input data, wherein the training input data comprises a plurality of input features, each of the input features comprises a training vulnerability and a training remediation of the training vulnerability;

obtaining training output data, wherein the training output data comprises a plurality of output predictions, each of the output predictions comprises a training validation associated with the training vulnerability and the training remediation of the corresponding input feature; and

training the model based on the training input data and the training output data.