Microsoft Technology Licensing, LLC

Kalpathy Sitaraman Sivaraman

Neelakantan Sundaresan

Roshanak Zilouchian Moghaddam

Yevhen Mohylevskyy

Aaron Yue-chiu Chan

Shaun Miller

Yijin Wei

Anant Girish Kharkar

A vulnerability detection and repair system utilize a classifier model to detect a software vulnerability in a source code snippet and the tokens in the source code snippet attributable to the vulnerability. A large language model is then given the vulnerable source code snippet, its vulnerability type, the vulnerability tokens, and a few-shot examples to determine whether or not the source code snippet includes the identified vulnerability. The few-shot examples include positive and negative samples of the type of vulnerability to guide the large language model towards the correct output.

Localizing vulnerabilities in source code at a token-level

A source code repair system generates a prompt including a few-shot examples of code changes made previously to correct a particular source code vulnerability. The prompt is given to a large language model to generate repair code for a source code snippet having the same vulnerability. Code changes made for a particular source code vulnerability, in the form of code diffs, are clustered into groups of closely related code change embeddings. A select few of the code diffs in each group having a closest mean of the cluster are used as the few-shot examples for the corresponding source code vulnerability.

Code-change based prompt for code repair

Runtime errors in a source code program are detected in advance of execution by machine learning models. Features representing a context of a runtime error are extracted from source code programs to train a machine learning model, such as a random forest classifier, to predict the likelihood that a code snippet has a particular type of runtime error. The features are extracted from a syntax-type tree representation of each method in a program. A model is generated for distinct runtime errors, such as arithmetic overflow, and conditionally uninitialized variables.

Detection of runtime errors using machine learning

Growing community of inventors

Redmond, WA, United States of America

Kalpathy Sitaraman Sivaraman