Source code vulnerability detection and repair through machine learning

1. A system comprising:

one or more processors; and

a memory that stores one or more programs that are configured to be executed by the one or more processors, the one or more programs including instructions that perform acts to:

access a pre-trained neural classifier model;

obtain at least one cybersecurity vulnerability source code sample and a plurality of non-vulnerable source code samples;

generate an embedding for the at least one cybersecurity vulnerability source code sample and for each of the plurality of non-vulnerable source code samples;

select ones of the plurality of non-vulnerable source code samples having an embedding similar to the embedding of the cybersecurity vulnerability source code sample; and

fine-tune the pre-trained neural classifier model with the at least one cybersecurity vulnerability source code sample and the select ones of the plurality of non-vulnerable source code samples, wherein the fine-tuned neural classifier model learns to predict whether a given source code snippet includes non-vulnerable code or a cybersecurity vulnerability.

2. The system of claim 1 , wherein pre-trained neural classifier model is trained with a plurality of unsupervised source code samples.

3. The system of claim 1 , wherein the cybersecurity vulnerability includes at least one Common Vulnerability and Exposures (CVE) vulnerability.

4. The system of claim 1 , wherein the cybersecurity vulnerability includes at least one Common Weakness Enumeration (CWE) vulnerability.

5. The system of claim 1 , wherein the one or more programs including instructions that perform acts to:

utilize the pretrained neural classifier model to generate the embedding for the at least one cybersecurity vulnerability source code sample and for each of the plurality of non-vulnerable source code samples.

6. The system of claim 1 , wherein the one or more programs include further instructions that perform acts to:

utilize the fine-tuned classifier model to generate a second embedding for the at least one cybersecurity vulnerability source code sample and for each of the plurality of non-vulnerable source code samples;

re-select ones of the plurality of non-vulnerable source code samples having a second embedding similar to the second embedding of the at least one cybersecurity vulnerability source code sample; and

re-tune the fine-tuned classifier model with the at least one cybersecurity vulnerability source code sample and the re-selected ones of the plurality of non-vulnerable source code samples.

7. The system of claim 1 , wherein the one or more programs include further instructions that perform acts to:

deploy the neural classifier model in an integrated development environment to identify vulnerable code predicted from a deep learning code generation model.

8. The system of claim 1 , wherein the one or more programs include further instructions that perform acts to:

deploy the neural classifier model in a source code version control system to identify vulnerable code in commit records.

9. The system of claim 1 , wherein the neural classifier model is a neural encoder transformer model with attention.

10. A computer-implemented method, comprising:

accessing a non-vulnerable embedding database having a plurality of embeddings, each of the embeddings associated with a non-vulnerable source code sample, the non-vulnerable source code sample associated with a non-vulnerable classification;

generating an embedding for each of a plurality of vulnerable source code samples, each of the plurality of vulnerable source code samples associated with a vulnerability classification;

for each of the plurality of vulnerable source code samples, searching in the non-vulnerable embedding database for a closest matching embedding;

constructing a first fine-tuning dataset including the plurality of vulnerable source code samples and the non-vulnerable source code samples having the closest matching embedding to a respective vulnerable source code sample; and

fine-tuning a pre-trained neural classifier model with the fine-tuning dataset to identify a likelihood of a given source code snippet associated with a vulnerability classification or a non-vulnerable classification.

11. The computer-implemented method of claim 10 , further comprising:

pre-training a neural classifier model on a plurality of unsupervised source code samples.

12. The computer-implemented method of claim 11 , further comprising:

generating each of the embeddings of the non-vulnerable source code samples in the non-vulnerable embedding database using the pre-trained neural classifier model.

13. The computer-implemented method of claim 10 , wherein the vulnerability classification includes at least one Common Vulnerability and Exposures (CVE) vulnerability and/or at least one Common Weakness Enumeration (CWE) vulnerability.

14. The computer-implemented method of claim 10 , further comprising:

re-generating the embeddings of the non-vulnerable source code samples and the vulnerable source code samples using the fine-tuned neural classifier model;

re-selecting ones of the plurality of non-vulnerable source code samples having a regenerated embedding similar to the regenerated embedding of each of the cybersecurity vulnerability source code samples; and

re-tuning the fine-tuned classifier model with the reselected non-vulnerable source code samples and the vulnerable source code samples having a similar re-generated embedding.

15. The computer-implemented method of claim 10 , wherein the pre-trained classifier model is a neural encoder transformer with attention.

16. A computer-implemented method, comprising:

obtaining a predicted source code snippet generated from a deep learning code generation model to complete a partially-formed source code snippet in a source code edit session;

identifying through a neural classifier model a likelihood of the predicted source code snippet including vulnerable code;

predicting using a neural transformer model, given the source code snippet, repaired code to remedy the predicted source code snippet including the vulnerable code; and

displaying in the source code edit session the repaired code to complete the partially-formed source code snippet.

17. The computer-implemented method of claim 16 , wherein the vulnerable code is associated with a Common Vulnerability and Exposures (CVE) vulnerability.

18. The computer-implemented method of claim 16 , wherein the vulnerable code is associated with a Common Weakness Enumeration (CWE) vulnerability.

19. The computer-implemented method of claim 16 , wherein the neural transformer model is a neural decoder transformer model with attention.

20. The computer-implemented method of claim 16 , wherein the neural classifier model is a neural encoder transformer model with attention.