International Business Machines Corporation

Yunhui Zheng

Jim Alain Laredo

John Erik Wittern

Aleksander A Slominski

Christopher Charles Young

Alessandro Morari

Annie T Ying

Annie Tsui Tsui Ying

Marco Pistoia

Julian Timothy Dolby

Yufan Zhuang

Omer Tripp

Zhong Su

Bo Yang

Shiwan Zhao

Honglei Guo

Mihaela Ancuta Bornea

Peng Liu

Jeffrey Scott McCarley

Sahil Suneja

Annie T T Ying

Saurabh Pujar

Luca Buratti

Techniques regarding training one or more AI models for a source code understanding task are provided. For example, one or more embodiments described herein can comprise a system, which can comprise a memory that can store computer executable components. The system can also comprise a processor, operably coupled to the memory, and that can execute the computer executable components stored in the memory. The computer executable components can comprise a training component that can train an artificial intelligence model on source code samples for a source code understanding task. The source code samples can be ranked based on code complexity.

Complexity based artificial intelligence model training

Techniques regarding augmenting one or more training datasets for training one or more AI models are provided. For example, one or more embodiments described herein can comprise a system, which can comprise a memory that can store computer executable components. The system can also comprise a processor, operably coupled to the memory, and that can execute the computer executable components stored in the memory. The computer executable components can comprise training augmentation component that can generate an augmented training dataset for training an artificial intelligence model by extracting a simplified source code sample from a source code sample comprised within a training dataset.

Training data augmentation via program simplification

In a computer-implemented method for improving a static analyzer output, a processor receives a labeled data set with labeled true vulnerabilities and labeled false vulnerabilities. A processor receives pretrained contextual embeddings from a contextual embeddings model. A processor maps the true vulnerabilities and the false vulnerabilities to the pretrained contextual embeddings model. A processor generates a fine-tuned model with classifications for true vulnerabilities.

Contextual embeddings for improving static analyzer output

Approaches presented herein enable fault detection. More specifically, implementation code of one or more functions is identified from source code. The implementation code of the one or more functions is converted to corresponding Abstract Syntax Trees (ASTs). The implementation code of the one or more functions is represented as a first plurality of sets of AST paths over the ASTs. Classification results for the one or more functions are generated with a classifier based on the first plurality of sets of AST paths for the implementation code of the one or more functions. Each of the classification results indicates a probability of having at least one fault in a corresponding function of the one or more functions. Fault detection results of the source code are generated based on the classification results.

Source code fault detection

A debugging tool and method for statically verifying programs that invoke web-based services through API calls is provided. The tool receives source code that comprises one or more invocation of web APIs for requesting web-based services. The tool also receives a set of web API specifications. The tool extracts a set of request information for each web API invocation in the source code, the set of request information including a usage string of an URL endpoint. The tool verifies whether the set of request information complies with the received web API specifications and reports a result of the verification.

Analysis to check web API code usage and specification

Synthesizing sanitization code for applications based upon a probabilistic prediction model includes receiving a set of applications. The set of applications is partitioned into a first subset of applications and a second subset of applications. The first subset has one or more malicious payloads associated therewith, and the second subset has one or more non-malicious payloads associated therewith. A probabilistic prediction model is computed based upon the malicious payloads associated with the first subset of applications. One or more predicted malicious payloads are predicted from the probabilistic prediction model.

Synthesizing sanitization code for applications based upon probabilistic prediction model

A method and system of matching an application program interface (API) code usage with an API specification are provided. A program having an API code usage is received and its features are extracted therefrom. Features from meta data of a plurality of API specifications are extracted. For each API specification of the plurality of API specifications, a match probability with the API code usage is determined. An API specification having a highest probability is determined. The API code usage is matched with the API specification having the highest probability.

Probabilistic matching of web application program interface code usage to specifications

A computer implemented method for testing an application according to usage data includes receiving an application to be tested and a set of usage data corresponding to the application to be tested, wherein the set of usage data corresponds to previously executed code sequences, identifying one or more code sequences of interest corresponding to the received application, wherein the code sequences of interest correspond to codes sequences that are configured to exercise the received application, extracting concrete usages of the code sequence of interest from the received set of usage data, generating one or more test cases for the application according to the extracted usages, and providing the one or more generated test cases. The method may additionally include testing the application according to the one or more generated test cases.

Gray-box testing based on concrete usages

Techniques for autonomously generating a code usage summary associated with a web application programming interface request are provided. In one example, a computer-implemented method can comprise evaluating, by a system operatively coupled to a processor, data from a data repository, wherein the evaluating is based on a defined machine learning process. Also, the computer-implemented method can comprise generating, by the system, a usage summary of the data, wherein the usage summary is based on a statistic derived from a web application programming interface request, and the web application programming interface request is associated with the data.

Approach to summarize code usage

A method and system of determining whether a specification is an accurate representation of an application program interface (API) is provided. The specification is received electronically over a network. Service calls to be tested are identified based on the specification. A test case is created for each of the identified service calls. A sequence is created for the test cases. A test plan is generated based on the created sequence. The generated test plan is executed. Upon identifying an error in response to the executed test plan, a notification is generated, indicating that the specification is not an accurate representation of the API.

Growing community of inventors

Elmsford, NY, United States of America

Yunhui Zheng