System and method for maintaining and securing software code
A system includes a memory configured to store a software codebase and an instance of vulnerabilities associated with the software codebase. The system further includes a processor coupled to the memory and configured to access the software codebase and execute a scan to identify sets of metadata associated with the software codebase. The processor is configured to execute a first machine-learning model trained to generate a prediction of feature clusters based on the sets of metadata. The plurality of feature clusters includes a ratio of a vulnerability to a time-intensiveness associated with remediating the vulnerability. The processor is configured to execute a second machine-learning model trained to generate a prediction of associations between the plurality of feature clusters and the instance of vulnerabilities. The prediction of associations includes an estimate of a time-intensiveness for remediating the instance of vulnerabilities.
1 . A system, comprising:
a memory configured to store a software codebase of at least one software application and an instance of one or more vulnerabilities associated with the software codebase; and
one or more processors operably coupled to the memory and configured to:
access the software codebase of the at least one software application;
execute, based on the software codebase, one or more code scans configured to identify one or more sets of metadata associated with the software codebase, wherein the identified one or more sets of metadata comprises an indication of one or more vulnerabilities associated with the software codebase;
execute a first machine-learning model trained to generate a prediction of a plurality of feature clusters based at least in part on the identified one or more sets of metadata, wherein each of the plurality of feature clusters comprises a ratio of a vulnerability to a time-intensiveness associated with remediating the vulnerability;
train a clustering machine-learning algorithm based at least in part on a data set of technical support requests requesting remediation of instances of the one or more vulnerabilities;
execute, in response to the training of the clustering machine-learning algorithm, a clustering machine-learning model to generate a prediction of one or more associations between each of the plurality of feature clusters and the instance of one or more vulnerabilities associated with the software codebase, wherein the prediction of the one or more associations comprises an estimate of a time-intensiveness for remediating the instance of one or more vulnerabilities associated with the software codebase;
output, by the clustering machine-learning model, the estimate of the time-intensiveness for remediating the instance of one or more vulnerabilities associated with the software codebase; and
patch the software codebase based at least in part on the estimate of the time-intensiveness to resolve the instance of one or more vulnerabilities associated with the software codebase.
2 . The system of claim 1 , wherein the estimate of a time-intensiveness comprises a confidence score by which a remediation of the instance of one or more vulnerabilities is to be compared.
3 . The system of claim 1 , wherein the identified one or more sets of metadata comprises metadata associated with one or more of a development history of the software codebase, a remediation history of the software codebase, a maturity level of the software codebase, or a coding style of the software codebase.
4 . The system of claim 1 , wherein the first machine-learning model comprises one or more of a supervised machine-learning model or a semi-supervised machine-learning model trained to generate the prediction of the plurality of feature clusters.
5 . The system of claim 1 , wherein the instance of one or more vulnerabilities associated with the software codebase is identified based on a static application security testing (SAST) scan of the software codebase, and wherein the SAST scan of the software codebase was executed during one or more of an implementation phase of the at least one software application, a development phase of the at least one software application, or a testing phase of the at least one software application.
6 . The system of claim 1 , wherein the one or more processors are further configured to deploy the patched software codebase.
7 . A method, comprising:
accessing a software codebase of at least one software application;
executing, based on the software codebase, one or more code scans configured to identify one or more sets of metadata associated with the software codebase, wherein the identified one or more sets of metadata comprises an indication of one or more vulnerabilities associated with the software codebase;
executing a first machine-learning model trained to generate a prediction of a plurality of feature clusters based at least in part on the identified one or more sets of metadata, wherein each of the plurality of feature clusters comprises a ratio of a vulnerability to a time-intensiveness associated with remediating the vulnerability;
training a clustering machine-learning algorithm based at least in part on a data set of technical support requests requesting remediation of instances of the one or more vulnerabilities;
executing, in response to the training of the clustering machine-learning algorithm, a clustering machine-learning model to generate a prediction of one or more associations between each of the plurality of feature clusters and an instance of one or more vulnerabilities associated with the software codebase, wherein the prediction of the one or more associations comprises an estimate of a time-intensiveness for remediating the instance of one or more vulnerabilities associated with the software codebase;
outputting, by the clustering machine-learning model, the estimate of the time-intensiveness for remediating the instance of one or more vulnerabilities associated with the software codebase; and
patching the software codebase based at least in part on the estimate of the time-intensiveness to resolve the instance of one or more vulnerabilities associated with the software codebase.
8 . The method of claim 7 , wherein the estimate of a time-intensiveness comprises a confidence score by which a remediation of the instance of one or more vulnerabilities is to be compared.
9 . The method of claim 7 , wherein the identified one or more sets of metadata comprises metadata associated with one or more of a development history of the software codebase, a remediation history of the software codebase, a maturity level of the software codebase, or a coding style of the software codebase.
10 . The method of claim 7 , wherein the first machine-learning model comprises one or more of a supervised machine-learning model or a semi-supervised machine-learning model trained to generate the prediction of the plurality of feature clusters.
11 . The method of claim 7 , wherein the instance of one or more vulnerabilities associated with the software codebase is identified based on a static application security testing (SAST) scan of the software codebase, and wherein the SAST scan of the software codebase was executed during one or more of an implementation phase of the at least one software application, a development phase of the at least one software application, or a testing phase of the at least one software application.
12 . The method of claim 7 , further comprising deploying the patched software codebase.
13 . A non-transitory computer-readable medium storing instructions that, when executed by one or more processors of a system, cause the one or more processors to:
access a software codebase of at least one software application;
execute, based on the software codebase, one or more code scans configured to identify one or more sets of metadata associated with the software codebase, wherein the identified one or more sets of metadata comprises an indication of one or more vulnerabilities associated with the software codebase;
execute a first machine-learning model trained to generate a prediction of a plurality of feature clusters based at least in part on the identified one or more sets of metadata, wherein each of the plurality of feature clusters comprises a ratio of a vulnerability to a time-intensiveness associated with remediating the vulnerability;
train a clustering machine-learning algorithm based at least in part on a data set of technical support requests requesting remediation of instances of the one or more vulnerabilities;
execute, in response to the training of the clustering machine-learning algorithm, a clustering machine-learning model to generate a prediction of one or more associations between each of the plurality of feature clusters and an instance of one or more vulnerabilities associated with the software codebase, wherein the prediction of the one or more associations comprises an estimate of a time-intensiveness for remediating the instance of one or more vulnerabilities associated with the software codebase;
output, by the clustering machine-learning model, the estimate of the time-intensiveness for remediating the instance of one or more vulnerabilities associated with the software codebase; and
patch the software codebase based at least in part on the estimate of the time-intensiveness to resolve the instance of one or more vulnerabilities associated with the software codebase.
14 . The non-transitory computer-readable medium of claim 13 , wherein the estimate of a time-intensiveness comprises a confidence score by which a remediation of the instance of one or more vulnerabilities is to be compared.
15 . The non-transitory computer-readable medium of claim 13 , wherein the identified one or more sets of metadata comprises metadata associated with one or more of a development history of the software codebase, a remediation history of the software codebase, a maturity level of the software codebase, or a coding style of the software codebase.
16 . The non-transitory computer-readable medium of claim 13 , wherein the first machine-learning model comprises one or more of a supervised machine-learning model or a semi-supervised machine-learning model trained to generate the prediction of the plurality of feature clusters.
17 . The non-transitory computer-readable medium of claim 13 , wherein the instance of one or more vulnerabilities associated with the software codebase is identified based on a static application security testing (SAST) scan of the software codebase, and wherein the SAST scan of the software codebase was executed during one or more of an implementation phase of the at least one software application, a development phase of the at least one software application, or a testing phase of the at least one software application.