Sap Se

Tom Ganz

Martin Haerterich

Philipp Rall

Erik Imgrund

Applications may contain vulnerabilities to attack via malicious inputs. Machine-learning models may be trained to detect these vulnerabilities by accepting source code as input and outputting a probability that each of a set of vulnerabilities exists in the source code. Explanation methods may identify one or more locations within the source code that are likely to cause the vulnerability. Directed fuzzing provides a range of inputs to source code. The inputs that cause the source code to fail are detected and the portions of the source code that were vulnerable are identified. The results of the directed fuzzing are used to select between explanations generated by multiple explanation methods, to provide additional training data to a machine-learning model, to provide additional training data to an explanation method, or any suitable combination thereof.

Directed fuzzing for vulnerability detection

A system and method include reception of a plurality of code samples and corresponding ground truth classifications, generation, for each of the plurality code samples, of a plurality of perturbed code samples, generation of first probabilities for each of the plurality of code samples and the perturbed code samples using a first classification model, generation of second probabilities for each of the plurality of code samples and the perturbed code samples using a second model, determination of a causal probability for each code sample based on the first probabilities and the second probabilities, determination of a causal performance metric of the first classification model based on the ground truth classifications and the causal probabilities, and presentation of the causal performance metric.

Growing community of inventors

Karlsruhe, Germany

Tom Ganz