Microsoft Technology Licensing, LLC

Aaron Yue-chiu Chan

Roshanak Zilouchian Moghaddam

Yevhen Mohylevskyy

Neelakantan Sundaresan

Kalpathy Sitaraman Sivaraman

Anant Girish Kharkar

Colin Bruce Clement

Eslam K Abdelreheem

Kyle P Jackson

Alexander Winthrop Helyar

Ahmed Ezzat Abdelgawad Magooda

Mohamed Ali Mohamed Elkamhawy

A vulnerability detection and repair system utilize a classifier model to detect a software vulnerability in a source code snippet and the tokens in the source code snippet attributable to the vulnerability. A large language model is then given the vulnerable source code snippet, its vulnerability type, the vulnerability tokens, and a few-shot examples to determine whether or not the source code snippet includes the identified vulnerability. The few-shot examples include positive and negative samples of the type of vulnerability to guide the large language model towards the correct output.

Localizing vulnerabilities in source code at a token-level

A source code repair system generates a prompt including a few-shot examples of code changes made previously to correct a particular source code vulnerability. The prompt is given to a large language model to generate repair code for a source code snippet having the same vulnerability. Code changes made for a particular source code vulnerability, in the form of code diffs, are clustered into groups of closely related code change embeddings. A select few of the code diffs in each group having a closest mean of the cluster are used as the few-shot examples for the corresponding source code vulnerability.

Code-change based prompt for code repair

Example solutions performing software code vulnerability reduction. An input code portion is extracted from input software code. The input code portion may be syntactically incomplete and/or syntactically incorrect. A code vulnerability is detected in the input code portion. A correction of the code vulnerability is made, and an output code portion is generated including the correction. In some examples, a code vulnerability detection tool takes, as input, the output from a code completion tool. The output is thus annotated or corrected in real-time, as a user is developing the code.

Vulnerability reduction for syntactically incomplete code

A neural classifier model is used to detect cybersecurity vulnerabilities in the source code predicted by a deep learning code generation model having been trained on source code possibly containing security bugs. Upon the classifier model classifying a given source code snippet as likely containing a cybersecurity vulnerability, a proposed repair for the cybersecurity vulnerability is predicted from a neural decoder transformer model having been trained on non-vulnerable source code. The neural decoder transformer model is used to predict source code that repairs the cybersecurity vulnerability given the source code classified with a cybersecurity vulnerability.

Source code vulnerability detection and repair through machine learning

Growing community of inventors

PROVO, UT, United States of America

Aaron Yue-chiu Chan