Microsoft Technology Licensing, LLC

Anant Girish Kharkar

Neelakantan Sundaresan

Roshanak Zilouchian Moghaddam

Yevhen Mohylevskyy

Kalpathy Sitaraman Sivaraman

Aaron Yue-chiu Chan

Colin Bruce Clement

Xiaoyu Liu

Xin Shi

Matthew Glenn Jin

A false positive vulnerability system detects whether a software vulnerability identified by a static code vulnerability analyzer is a true vulnerability or a false positive. The system utilizes deep learning models to predict whether an identified vulnerability is accurate given the source code context of the identified vulnerability. A neural encoder transformer model is trained to classify a false positive given the method body including the identified vulnerability. A neural decoder transformer model is trained to predict a candidate line-of-code to complete a prompt inserted into the context of the identified vulnerability. The candidate line-of-code that successfully completes the prompt is used as a signal to identify that the identified vulnerability is a false positive.

False positive vulnerability detection using neural transformers

A vulnerability detection and repair system utilize a classifier model to detect a software vulnerability in a source code snippet and the tokens in the source code snippet attributable to the vulnerability. A large language model is then given the vulnerable source code snippet, its vulnerability type, the vulnerability tokens, and a few-shot examples to determine whether or not the source code snippet includes the identified vulnerability. The few-shot examples include positive and negative samples of the type of vulnerability to guide the large language model towards the correct output.

Localizing vulnerabilities in source code at a token-level

A source code repair system generates a prompt including a few-shot examples of code changes made previously to correct a particular source code vulnerability. The prompt is given to a large language model to generate repair code for a source code snippet having the same vulnerability. Code changes made for a particular source code vulnerability, in the form of code diffs, are clustered into groups of closely related code change embeddings. A select few of the code diffs in each group having a closest mean of the cluster are used as the few-shot examples for the corresponding source code vulnerability.

Code-change based prompt for code repair

Growing community of inventors

HUNTERSVILLE, NC, United States of America

Anant Girish Kharkar