Accenture Global Solutions Limited

Ganesh Devarajan

Mário Lauande Lacroix

Karel Kohout

Richard Levine

John Donovan Delmare, Jr

Malek Ben Salem

Krishna Mohan Dasari

Finbarr S Tarrant

Sidath Handurukande

Johnny Obando

Owen McGauley

Chase Alan Sylvester

David Glyn Darkin

Mehdi Sanoh

Mohnish Gahlot

Dalton Harris

Steven Nicholas Strupp

Cristian Daniel Ariza

Jason Widen

Matt Renzi Quillosa

Vidya Govindan

A code remediation system accesses a programming code including vulnerabilities such as potential secrets and remediates at least a subset of the potential secrets to generate modified programming code wherein the subset of potential secrets which are determined to be actual secrets are replaced with access mechanisms to storage locations on a vault wherein the actual secrets are secured. To identify the subset of potential secrets forming the actual secrets to be remediated, the code remediation system is configured to filter out false positives among the potential secrets and identify true positives. When an application executing the modified code encounters an access mechanism, it accesses the vault to retrieve the actual secrets.

Programming code vulnerability remediation

The proposed systems and methods apply natural language processing to identify implicit security requirements flowing from input text narratively describing desired features for a software project. These systems and methods can identify hidden security requirements that may not be readily apparent from the features described in the input text. For example, a story may include a feature of a return URL (Uniform Resource Locator), which is the URL for the website to which a user will be redirected. A security vulnerability that would not be obvious from this feature is that a user might be directed to an attacker controlled site instead of the originally intended site. A security requirement that could counteract this vulnerability would be to include the feature of verifying all redirects go to Whitelisted Sites. The proposed systems and methods provide a framework for automated security requirements analysis capable of identifying unstated security requirements early on in a software development lifecycle using artificial intelligence techniques.

Artificial intelligence based security requirements identification and testing

Systems and methods are provided for the classification of identified security vulnerabilities in software applications, and their automated triage based on machine learning. The disclosed system may generate a report listing detected potential vulnerability issues, and extract features from the report for each potential vulnerability issue. The system may receive policy data and business rules, and compare the extracted features relative to such data and rules. The system may determine a token based on the source code of a potential vulnerability issue, and a vector based on the extracted features of a potential vulnerability issue and based on the token. The system may select a machine learning modelling method and/or an automated triaging method based on the vector, and determine a vulnerability accuracy score based on the vector using the selected method.

Systems and methods for triaging software vulnerabilities

A device may receive contextual data, computational data, experiential data, and industry data associated with software code, and may receive detected vulnerabilities data identified by a scanning model based on the software code and software code metadata of the computational data. The device may process the contextual data, the computational data, and the experiential data, with a contextual identification model, to determine a set of rules and a set of actions, and may enrich, via an enrichment model, the industry data with the experiential data to generate enriched industry data. The device may process the software code metadata, the detected vulnerabilities data, and the enriched industry data, with a correlation model, to generate analysis data, and may process the analysis data and the set of rules, with a security model, to confirm security issues associated with the software code. The device may perform one of the set of actions based on the security issues.

Utilizing orchestration and augmented vulnerability triage for software security testing

Growing community of inventors

Hawthorn Woods, IL, United States of America

Ganesh Devarajan