Microsoft Technology Licensing, LLC

Jacek Andrzej Czerwonka

Christopher Michael Henry Faucon

Nicolas Yves Couraud

Michael C Fanning

Dragos Daniel Boia

Maksim Shmelev

Arno Mihm

Hardik Goel

Joseph M Joy

Nikolaj Skallerud Bjorner

Vipindeep Vangala

Sriram Kottarakurichi Rajamani

Shuvendu K Lahiri

Eugene Wilson Hodges, Iv

Suresh Thummalapenta

Balasubramanyan Ashok

Etan Micah Basseri

Danielle Nicole Gonzalez

Suvam Mukherjee

Gopal Ranganatha Srinivasa

Flore Q Yuan

Hongkang Liang

August Shi

Ziying Zheng

Aleks M Gershaft

Yingting Yu

Juan A Llanes-Tosar

Jacek Ernest Lichwa

Floyd Odiwuor K'otohoyoh

Alison Lynne Maclellan

Eddy Toshiyuki Okada Nakamura

Techniques for identifying an exposed credential that, if used, would provide access to a resource are disclosed. The techniques enable the resource to remain online while (i) a new credential is allocated for the resource, (ii) the resource is transitioned to using the new credential instead of the exposed credential, and (iii) the exposed credential is attempted to be invalidated. A credential is accessed. This credential is suspected of being in an exposed state. The credential is accessible from within an artifact and is determined to be in the exposed state. A new credential is generated. This new credential is designed to replace the exposed credential. An instruction is transmitted to the resource to cause it to transition from using the exposed credential to using the new credential. The exposed credential is then invalidated.

Automated remediation of exposed secrets

Disclosed systems and methods identify a data record set and determine whether one or more predetermined conditions exist for triggering analysis of one or more records in the data record set. Disclosed embodiments trigger the analysis only in response to determining that the predetermined conditions have been met. Upon triggering the analysis of the data record set, disclosed embodiments identify a subset of the data record set to undergo the analysis while refraining from performing the analysis on the remaining records in the data record set. Further, embodiments identify an analysis model based on a level of analysis to be performed and apply the analysis model to the subset of the data record set to identify any presence of sensitive data. Lastly, disclosed embodiments selectively perform a security process to the data record set in response to detecting the presence of the sensitive data.

Telemetry sampling scanning for exposed secrets and other sensitive data

Techniques for (i) using contextual information associated with an exposed credential to identify a resource that could be accessed using the exposed credential, (ii) identifying a responsible entity of that resource, and (iii) alerting the responsible entity about the exposed credential are disclosed. A credential is determined to be in an exposed state. The exposed credential, if used, could potentially provide an actor access to a resource, despite the fact that the actor should not have access to the resource. The exposed credential is analyzed to determine a context. Based on that context, the resource is identified. A responsible entity associated with the resource is identified. An alert is then sent to that entity.

Enriching exposed credential search results to make them actionable

Integrating super-app extension discovery and configuration within source code management platform comments. Based on a triggering event associated with a context within a code repository, a super-app identifies a set of extensions available for execution against the context, and triggers execution of at least a subset of the set of extensions against the context. The super-app generates a super-app output that includes an output of having triggered the subset of extensions against the context, a listing of one or more of the set of extensions as being a library of available extensions to the super-app, and an indication of a comment-based syntax for configuring an extension to the super-app. The super-app posts that output as a comment on a comment feed. Based on user input received via a comment using the comment-based syntax, the super-app generates a modified super-app configuration associated with the code repository.

Super-app extension discovery and configuration via source code management platform comments

The estimation and visualization of a degree of change between a further edited state of code and a selected version of the code. For each of some counted added or deleted portions (e.g., code lines) of code, the system estimates that the added (or deleted) portion complies with a non-review characteristic. The added (or deleted) code lines that comply with a non-review characteristic are excluded from the estimation of the degree of change. Thus, the estimation excludes consideration of added or deleted portions that need no substantial review, while considering more substantial added or deleted portions in the estimations. The estimation is then visualize giving the developer or the reviewer a better idea of the scale of changes that has really been made since the selected version of the code.

Change estimation in version control system

An automated method of making a prediction regarding development of a software product includes receiving code changes information, build information, and failure information related to the software product. Entries are stored in a database, wherein each entry links a subset of the code changes information with a subset of the build information and with a subset of the failure information. A first matrix and a second matrix are generated using the entries in the database. Multi-target entropy calculations are performed based on the first matrix and the second matrix. The prediction regarding the development of the software product is performed based on the multi-target entropy calculations.

Making a prediction regarding development of a software product

The factorization of test components when performing component-level regression testing in iterative builds of a computing system that consists of many working components. Performance metrics for test components are maintained across multiple builds of the computing program. To perform factorization, multiple factorings of a test component are identified and evaluated until a suitable improvement in the maintained performance metric for each corresponding test component is achieved (e.g., via simulation). This may be performed, across multiple of the test components. This process may be iterated through such that the set of test components being factored and evaluated in a subsequent iteration may in fact be a test component created by factorization in a prior iteration. The net result is that the factorization achieves improvement in performance metrics of the test components.

Test components factorization in a build system

Software debugging recommendation technique embodiments are presented that generally entails creating a database of characterized software bug descriptions and providing software debugging recommendations from the database in response to a query. This can employ a two-phased approach in the search for similar software bugs. The first is a search phase that takes a query as input and returns a ranked list of software bug descriptions that match the query. These bug descriptions can contain a mix of structured and unstructured data. The second phase is a related-information phase that uses the output of the first phase to retrieve a set of related recommendations such as for people, source files, functions and binaries.

Software debugging recommendations

A system and method for testing sequences of computer-related operations by using subsequences of operations of a given length. The subsequences are used to construct a suite of test cases that reduces the number of testing permutations while satisfying desired testing requirements. A mechanism generates test cases by listing the possible subsequences of a specified length, from which a subsequence is chosen to start a test case, and marked as covered. A selection algorithm may be used to choose a subsequence, such as based on a count of the number of subsequence elements starting still uncovered subsequences. Subsequences are added to the test case until a specified maximum length, with a preference for selecting uncovered subsequences. The process continues adding test cases until no subsequence remains uncovered. The resultant set of test cases is processed based on any specified constraints and preconditions, to produce a final suite of test cases.

Method and system for efficient testing of sequences of computer-related operations

Provided is a system and method comprising a test suite generation mechanism for testing a domain (e.g., software program) via 'black-box' testing. Parameters are defined, appropriate values for each are chosen, and via the system and method a suite of test cases are automatically generated that covers all N-way parameter combinations (e.g., pairs when N=2) while respecting any specified domain constraints. After receiving a model comprising the parameters and respective values to test, along with constraints in a form of logical predicates, the system and method produces the test cases. Based on the constraints, an algorithm removes invalid combinations in a first stage, and prevents any other invalid combinations from being used in a second stage during the test case generation process. A full set of statistically valuable test cases are thus efficiently and automatically generated, significantly improving testing while significantly reducing the resources needed to test.

Method and system for generating an efficient test suite from a domain description with given constraints

Provided is a system and method for black-box testing of software using positive and negative test cases with N-way combinations of parameter values. An original model comprising valid and invalid values is modified in a first phase, by generating exclusions (constraints) for pairs of invalid values. A first suite of test cases is generated from the modified model, and positive test cases eliminated, creating a first test suite with only negative tests. In a second phase, the original model is modified by eliminating invalid values, from which a second test suite having only positive test cases for all valid N-way combinations is generated. Merging the two test suites provides a suite of positive and negative test cases that test software with N-way combinations of values, in which each negative test case has only one invalid value.

Growing community of inventors

Sammamish, WA, United States of America

Jacek Andrzej Czerwonka