Vulnerability reduction for syntactically incomplete code
Example solutions performing software code vulnerability reduction. An input code portion is extracted from input software code. The input code portion may be syntactically incomplete and/or syntactically incorrect. A code vulnerability is detected in the input code portion. A correction of the code vulnerability is made, and an output code portion is generated including the correction. In some examples, a code vulnerability detection tool takes, as input, the output from a code completion tool. The output is thus annotated or corrected in real-time, as a user is developing the code.
1. A system comprising:
a processor; and
a computer-readable medium storing instructions that are operative upon execution by the processor to:
receive input software code from a development environment;
extract an input code portion at least by applying a sliding window to the input software code, the sliding window having a sliding window length;
detect a code vulnerability within the input code portion using a machine learning (ML) model trained on a code segment having a length equal to the sliding window length, the code segment having a dependency external to the code segment,
the ML model having an input layer having a size equal to the sliding window length, and
the ML model having an output layer having a size based on a number of different vulnerability classes;
generate, from the input code portion and the detection of the code vulnerability, an output code portion containing a correction of the code vulnerability; and
send the output code portion to the development environment.
2. The system of claim 1 , wherein the sliding window has a length of 50 or fewer characters.
3. The system of claim 1 , wherein the input code portion is syntactically incomplete.
4. The system of claim 1 , wherein the input code portion comprises a portion of software code in a software language selected from the list consisting of:
Java, Python, R, and a C-based language.
5. The system of claim 1 , wherein the code vulnerability comprises a vulnerability selected from the list consisting of:
a hard-coded credential, cleartext logging, and structured query language (SQL) injection.
6. The system of claim 1 , wherein generating the output code portion is performed within 20 milliseconds of receiving the input code portion.
7. The system of claim 1 , wherein the correction of the code vulnerability comprises an annotation to the output code portion identifying the code vulnerability.
8. A computer-implemented method comprising:
receiving syntactically incomplete input software code;
extracting an input code portion at least by applying a sliding window to the input software code, the sliding window having a sliding window length;
detecting a code vulnerability within the input code portion using a machine learning (ML) model trained on a code segment having a length equal to the sliding window length,
the ML model having an input layer having a size equal to the sliding window length, and
the ML model having an output layer having a size based on a number of different vulnerability classes; and
generating, from the input code portion and the detection of the code vulnerability, an output code portion containing a correction of the code vulnerability.
9. The computer-implemented method of claim 8 , wherein the sliding window has a length of 50 or fewer characters.
10. The computer-implemented method of claim 8 , further comprising sending the output code portion to a development environment.
11. The computer-implemented method of claim 8 , further comprising:
detecting malicious logic within the input code portion using the ML model; and
generating, from the input code portion and the detection of the malicious logic, an alert indicating that the input code portion comprises the malicious logic.
12. The computer-implemented method of claim 8 , wherein the code vulnerability comprises a vulnerability matched from a common weakness enumeration (CWE) dictionary.
13. The computer-implemented method of claim 8 , wherein generating the output code portion is performed within 20 milliseconds of receiving the input code portion.
14. The computer-implemented method of claim 8 , wherein the correction of the code vulnerability comprises an annotation to the output code portion identifying the code vulnerability.
15. A computer storage device having computer-executable instructions stored thereon, which, on execution by a computer, cause the computer to perform operations comprising:
receiving input software code;
extracting an input code portion at least by applying a sliding window to the input software code, the sliding window having a sliding window length;
detecting a code vulnerability within the input code portion using a machine learning (ML) model trained on a code segment having a length equal to the sliding window length,
the ML model having an input layer having a size equal to the sliding window length, and
the ML model having an output layer having a size based on a number of different vulnerability classes; and
generating, from the input code portion and the detection of the code vulnerability, in real time, an output code portion containing a correction of the code vulnerability.
16. The computer storage device of claim 15 , wherein the input code portion has a length of 50 or fewer characters.
17. The computer storage device of claim 15 , wherein the sliding window is syntactically incomplete.
18. The computer storage device of claim 15 , wherein the input code portion comprises a portion of software code in a software language selected from the list consisting of:
Java, Python, R, and a C-based language.
19. The computer storage device of claim 15 , wherein the code vulnerability comprises a vulnerability selected from the list consisting of:
a hard-coded credential, cleartext logging, and structured query language (SQL) injection.
20. The computer storage device of claim 15 , wherein the correction of the code vulnerability comprises an annotation to the output code portion identifying the code vulnerability.