Endor Labs Inc

Dimitrios Styliadis

Philip Hamer

Joseph Hejderup

Henrik Plate

Georgios Apostolopoulos

Georgios Gousios

Alexandre Wilhelm

Anand Ashok Sawant

Camilla Odlund

Thomas Durieux

In some examples, a server injects malicious code into a legitimate software package to create an injected package. The server uses an artificial intelligence to extract a plurality of parts from the injected package and to mutate individual parts of the plurality of parts to create mutated parts. The server assembles the mutated parts to create a mutated malware. A malware scanner determines a risk score associated with the mutated malware. Based at least in part on determining that the score satisfies a predetermined threshold, the server stores the mutated malware in a set of mutated malware and creates at least one additional mutation based on the mutated malware. After determining that a size of the set of mutated malware satisfies a requested size, the malware scanner is modified to increase detection of the malicious code in individual mutated malware in the set of mutated malware.

Using artificial intelligence to generate test data to test malware scanner(s)

In some examples, a server determines that project code calls a component in a third-party library that has been updated. The server determines a first type hierarchy associated with the component, a second type hierarchy associated with the updated component, and performs a type hierarchy comparison of the first and the second type hierarchy. The server determines a first call graph associated with the component, determines a second call graph associated with the updated component, and performs a call graph comparison of the first and second call graph. Based at least in part on the type hierarchy comparison and the call graph comparison, the server determines a set of breaking changes associated with the updated component, with each breaking change in the set identifying changes to the updated component, relative to the component, that are determined to cause an incompatibility when the project code calls the updated component.

Impact analysis of changes in third-party software components on downstream users

In some implementations, a set of dependencies in a selected package are determined. Each dependency in the set of dependencies is used to create a set of partial call graphs that are stitched together to create a complete call graph of the package. A subset of upgrade candidates may be selected from a set of upgrade candidates for a particular dependency. Determining issues associated with upgrading the package to use an upgrade candidate includes determining security vulnerabilities based on the complete call graph, determining a number of vulnerabilities addressed by upgrading the package to use the upgrade candidate, and determining a severity of vulnerabilities addressed by upgrading the package to use the upgrade candidate. A risk-benefit score associated with each of the upgrade candidates is determined to create a subset of upgrade candidates prioritized based on the risk-benefit score. The prioritized subset is provided to a developer associated with the package.

Creating and using call graphs to select an update

In some examples, a code file in a development system is selected and the selected code file is segmented, using a language-specific parser, to create multiple parsed blocks. A block of the multiple parsed blocks is selected and a cryptographic hash function used to create a block signature that uniquely identifies the selected block. The block signature is compared to multiple signatures of blocks in third-party libraries. The multiple signatures are stored in an index. When the block signature matches one of the multiple signatures of blocks in third-party libraries, the index is used to determine a source file from which the selected block was copied. Vulnerabilities included in the source file and fixes to address the vulnerabilities are identified to enable a software developer to apply the fixes to the identified vulnerabilities.

Software composition analysis (SCA) to identify AI-generated code that is copied code from third-party libraries

In some implementations, dependencies associated with a package selected from a software project are determined. Each dependency of the dependencies is used to create a set of partial call graphs that are stitched together to create a complete call graph of the package. A set of upgrade candidates for a dependency is determined. An upgrade candidate from the set of upgrade candidates is determined. Based on the complete call graph, issues associated with upgrading the package to use the upgrade candidate are determined. For each upgrade candidate in the set of the upgrade candidates, a risk-benefit score is determined based on issues associated with upgrading the package to use the upgrade candidate, a number of vulnerabilities, and a severity of the vulnerabilities addressed by upgrading the package to use the upgrade candidate. The upgrade candidates are prioritized based on the risk-benefit score to create prioritized upgrade candidates that are provided to a software developer.

Using call graphs to identify an update when upgrading to a newer version

In some implementations, a package is selected and a set of dependencies associated with the package are determined. Individual dependencies in the set of dependencies are used to create a set of partial call graphs that are stitched together to create a complete call graph of the package. A set of upgrade candidates for a dependency is determined. For an upgrade candidate, issues associated with upgrading the package to use the upgrade candidate are determined, a state of a dependency graph associated with upgrading are determined, diamond dependencies in the dependency graph are determined, a number of vulnerabilities and a severity of the vulnerabilities addressed by upgrading to the upgrade candidate are determined, and a risk-benefit score associated with each upgrade candidate is determined. The upgrade candidates are prioritized based on the associated risk-benefit score to create prioritized upgrade candidates that are provided to a software developer.

Determining call graphs to identify which update of a code dependency to use

A non-transitory computer-readable media, method, and server for detecting and addressing vulnerabilities are described. For example, a server receives a security advisory of a vulnerability of a function in a third-party library, accesses a version control system of the third-party library to identify fix commits that address the vulnerability, determines files corresponding to functions in the third-party library that include the vulnerability, performs a comparison before and after a code change was made to the files, identifies functions that included the vulnerability and have been modified to address the vulnerability, performs a search for component versions that include the individual functions that included the vulnerability, generates an enriched vulnerability description that includes identifiers of package versions that include: fixed versions and vulnerable versions of the functions, and modifies project code in a development system to use the fixed versions of the functions.

Identifying and addressing potential vulnerabilities in third-party code

A non-transitory computer-readable media, method and server for detecting and addressing vulnerabilities in a third-party code are described. In some examples, a server receives a security advisory that includes a description of a vulnerability and accesses a version control system (VCS) used by a third-party library to determine additional resources related to the vulnerability. The server determines a set of code changes performed by the project maintainers in the VCS, identifies one or more fix commits that address the vulnerability, and identifies one or more functions with the vulnerability that have been changed by the fix commits. The server performs a search for components and component versions that include the one or more functions with the vulnerability and generates an enriched vulnerability description that includes identifiers of package versions that include fixed versions of the one or more functions and vulnerable version of the one or more functions. Project code in a development system is modified to use the fixed versions of the one or more functions.

Growing community of inventors

San Jose, CA, United States of America

Dimitrios Styliadis