International Business Machines Corporation

Amazon Technologies, Inc.

Globalfoundries Inc.

Google Inc.

Globalfoundries U.S. 2 LLC

Omer Tripp

Marco Pistoia

Omri Weisman

Roee Hay

Salvatore Angelo Guarnieri

Takaaki Tateishi

Evgeny Beskrovny

Pietro Ferrara

Daniel Kalman

Yinnon Avraham Haviv

Adi Sharabani

Emmanuel Wurth

Yair Amit

Roi Saltzman

Iosif Viorel Onut

Paul Ionescu

Ory Segal

Ryan Berg

Stephen Darwin Teilhet

Alexander Landa

Supriyo Chakraborty

Gegi Thomas

Joseph W Ligman

Shahar Sperling

Lior Horesh

Julian Timothy Dolby

Raya Horesh

Sagi Kedmi

Paolina Centonze

Dmitri Pikus

Stephen Fink

Manu Sridharan

Frank Tip

Ori Segal

Shay Artzi

John Thomas Peyton, Jr

Kristofer Alyn Duer

Pranav Garg

Lotem Guy

Igal Kreichman

Matthias Daniel Dietsch

Petar Tsankov

Aharon Abadi

Guy Podjarny

Qiang Zhou

Sengamedu Hanumantha Rao Srinivasan

Rajdeep Mukherjee

Robert Wiener

Lucas Brutschy

Avishai Vana

Mudhakar Srivatsa

Raghu Kiran Ganti

Salman Abdul Baset

Jonathan Bnayahu

Stephen Peter Wood

Yishai Abraham Feldman

Guy-Vincent Jourdan

Peng Liu

Gregor Von Bochmann

Michael George Burke

John Peyton

Philippe Suter

Srinivasan Sengamedu Hanumantha Rao

Ran Ettinger

Igor Peshansky

David N Kaplan

Hoan Nguyen

Bertrand Cormier

Alexander Landau

Julien Canches

Seyed Ali Moosavi Byooki

Jerome Gout

Peter Kenneth Malkin

Wei Wang

David M Lubensky

John J Ponzo

Gal A Shachor

Jasmeet Chhabra

Michael Wilson

Franjo Ivancic

Moria Abadi

Aleksandr Y Aravkin

Idan Ben-Harrush

Samuel Kallner

Eran Yahav

Martin Vechev

Yunhui Zheng

Nili Guy

Ronen Bachar

Ronny Luss

Yoav Rubin

Andrei Kirshin

Alexander Dvinsky

Luciano Bello

Domagoj Babic

Yingjun Lyu

Yoav Shany

Hakimuddin Hanif

Shih-Wei Li

Ariel Sakin

A method for string analysis in a code scanning engine comprises a string analysis rule definition, the string analysis rule definition including a search pattern and a test criterion. At least a portion of a string in a source code file is determined to be a match to the search pattern. The test criterion is evaluated against at least a portion of the string. An indication of a result of the evaluation of the first test criterion is provided.

String analysis in a code scanning engine

Aspects of the disclosure provide for automatically generating patches for security violations. For example, a plurality of inputs may be generated for code. The code may be executed using the plurality of inputs to obtain execution states at a plurality of code locations. The execution states may include at least one security violation for at least some of the plurality of inputs. Using the execution states, one or more patch conditions causing the at least one security violation may be determined. Using the execution states, one or more corresponding patch locations may be determined based on a code location of the plurality of code locations where the at least one security violation each of the one or more patch conditions occurred. At least one candidate patch for the at least one security violation may be automatically generated. The at least one candidate patch may include one of the patch conditions and one of the corresponding patch locations.

Automatic generation of patches for security violations

Code changes may be hierarchically clustered to discover coding practices. Code change graphs for changes to code in a source code repository may be clustered according to hierarchy of different features determined for the source code into groups. The code change graphs in the groups may then be indexed according their similarity with other code change graphs in the groups. Then one or more coding practices corresponding to the indexed code changes may be provided.

Hierarchical clustering for coding practice discovery

Techniques for analyzing code are described. In some instances, a code analysis service is implemented by one or more electronic devices, the code analysis service including instructions that upon execution cause the code analysis service to: perform a program analysis to mine a code segment of the stored code to generate a descriptor of each input in the code segment that appears to be have insufficient input validation; assess that an input has insufficient validation and determining a classification of input validation to use by determining a category of input validation to apply to the input; acquire suggestion for the determined category; and provide the acquired suggestion for the determined category.

Detecting, and recommending fixes for, insufficient validation of user inputs in computer software

A method and method for testing an application includes performing a static analysis of metadata of coding of an application, using a test application program executed by a processor on a computer. Available user interface states are simulated based on the static analysis. A configuration file of the application is accessed and parsed to enumerate states possible for the application. A coverage metric is calculated for the application based on a number of states reached by the simulating and a number of states possible.

Building coverage metrics and testing strategies for mobile testing via view enumeration

Techniques for providing a visual code review editor are described. An electronic device is caused to display a graphical user interface including an editor portion to edit code review rules used by a code review service of a cloud provider network. The editor portion of the graphical user interface is caused to display a first graph associated with a first code review rule, the first graph including a first node, a second node, and a first edge connecting the first node and the second node. An indication that a third node has been added to the graph via the editor portion of the graphical user interface is received. The first code review rule is updated by the code review service to reflect the addition of the third node, the first code review rule is in a text format.

Visual query language for code review rules

A method includes computing a diffusion vector starting with a seed, querying nodes for connections, reweighting diffusion vector based on the degrees, sorting nodes based upon magnitude in the reweighted diffusion vector which is obtained through wave relaxation solution of a time-dependent initial value problem, detecting a community through a sweep over the nodes according to their rank, and selecting a prefix that minimizes or maximizes an objective function.

System and method for discovering ad-hoc communities over large-scale implicit networks by wave relaxation

An aggregate representation of a collection of source code examples is constructed. The collection includes positive examples that conform to a coding practice and negative examples do not conform to the coding practice. The aggregate representation includes nodes corresponding to source code elements, and edges representing relationships between code elements. Using an iterative analysis of the aggregate representation, a rule to automatically detect non-conformance is generated. The rule is used to provide an indication that a set of source code is non-conformant.

Example-based synthesis of rules for detecting violations of software coding practices

Preliminary program analysis of an executable may be performed. A security vulnerability level of a portion of the executable may be determined based on the preliminary program analysis. The security vulnerability level of the portion may be compared to a security vulnerability threshold. The precision of runtime monitoring of the portion may be tuned based on the comparison.

Precision-tuned runtime monitoring

Techniques for facilitating incremental static program analysis based on machine learning techniques are provided. In one example, a system comprises a feature component that, in response to an update to a computer program, generates feature vector data representing the update, wherein the feature vector data comprises feature data representing a feature of the update derived from an abstract state of the computer program, and wherein the abstract state is based on a mathematical model of the computer program that is generated in response to static program analysis of the computer program. The system can further comprise a machine learning component that employs a classifier algorithm to identify an affected portion of the mathematical model that is affected by the update. The system can further comprise an incremental analysis component that incrementally applies the static program analysis to the computer program based on the affected portion.

Machine learning to facilitate incremental static program analysis

Searching a service registry system including a plurality of services identified by respective service names, wherein at least some of said service names being associated with a set of client identifiers, includes receiving a search request, said request including a service name and a further set of client identifiers, searching, using a processor, the service registry system for a match between the requested service name and a service name of one of said services in the service registry system, and, in the absence of such a match, searching, using the processor, the service registry system for services that have an association with at least some of the client identifiers in said further set. A search result can be returned.

Finding services in a service registry system of a service-oriented architecture

Techniques for management of sensitive data using static code analysis are described. A method of management of sensitive data using static code analysis includes obtaining a representation at least a portion of code, statically analyzing at least the portion of code to generate one or more candidate vectors based at least on one or more patterns, sending the one or more candidate vectors to a sensitive data model, and receiving an inference response indicating, for each of the one or more candidate vectors, whether at least a portion of the candidate vector includes sensitive data and a corresponding confidence score.

Management of sensitive data using static code analysis

Techniques for program verification are described. An exemplary method includes receiving a request to evaluate code based on a customized rule, the customized rule comprising one or more conditions for which the customized rule is applicable and one or more postconditions to indicate at least one check to perform for a given node in a graph for the code, wherein an application of the customized rule performs one or more of: an interleave between a backward analysis and forward analysis based on user-specified conditions, an analysis between sub-graphs by a query from a first sub-graph to a second sub-graph, and an operation on a sub-graph, storage of a result of the operation on the sub-graph, and usage of the stored result in a subsequent operation; generating a graph for the code; and evaluating the code by applying the customized rule to the generated graph.

Data flow tracking in program verification

Techniques for performing root cause analysis in dynamic software testing via probabilistic modeling are provided. In one example, a computer-implemented method includes initializing, by a system operatively coupled to a processor, a threshold value, a defined probability value, and a counter value. The computer-implemented method also includes, in response to determining, by the system, that a probability value assigned to a candidate payload of one or more candidate payloads exceeds the defined probability value, and in response to determining, by the system, that the counter value exceeds the threshold value: determining, by the system, that a match exists between the candidate payload and an input point based on an application of the candidate payload to the input point resulting in a defined condition, wherein the one or more candidate payloads are represented by population data accessed by the system.

Root cause analysis in dynamic software testing via probabilistic modeling

Techniques for a code reviewer service to provide recommendations on source code are described. A code reviewer service may run rules and/or machine learning models to provide the recommendations. A machine learning model may identify one or more predicted issues of source code, and the code reviewer service may provide one or more recommendations based at least in part on the one or more predicted issues. Code reviewer service may allow a pull request for a code repository to trigger the generation of recommendations for the source code in the repository. The recommendations may be posted on the pull request.

Customizable service for recommendations on source code quality

Growing community of inventors

Bronx, NY, United States of America

Omer Tripp