Targeted security monitoring using semantic behavioral change analysis

A computer-implemented method comprising:

• performing an instruction-level comparison between a first build of a software project and a second build of the software project to yield an instruction difference, wherein the first build was generated using a first one or more source files and the second build was generated using a second one or more source files that resulted from a code commit being applied to the first one or more source files;
• generating a change impact, based at least in part on the instruction difference, that indicates behavioral differences between the first build of the software project and the second build of the software project;
• performing a security analysis of one or more parts of the software project identified based at least in part on the behavioral differences indicated by the change impact to determine a security risk value for the code commit, the security analysis including:
• identifying, based at least in part on a strongly-connected analysis, a plurality of parts of the software project having behavioral impacts due to the code commit;
• performing, by a first compute instance, a first program analysis of a first part of the plurality of parts of the software project;
• and
• performing, by a second compute instance, a second program analysis of a second part of the plurality of parts of the software project;
• and
• transmitting, to an electronic device, the security risk value for the code commit.

A non-transitory computer-readable storage medium storing instructions which, when executed by one or more processors of one or more computing devices, cause the one or more computing devices to:

• generate an instruction difference between a first build of a software project and a second build of the software project, wherein the second build was generated after a code commit was applied to the software project and the first build was generated before the code commit was applied to the software project;
• generate a change impact, based at least in part on the instruction difference, that indicates behavioral differences between the first build and the second build;
• perform a security analysis of one or more parts of the software project identified based at least in part on the behavioral differences indicated by the change impact to determine a security risk value for the code commit, the security analysis including:
• performing a strongly-coupled component analysis to identify a plurality of weakly connected parts of the software project having behavioral impacts resulting from the code commit;
• performing, by a first compute instance, a first program analysis of a first part of the plurality of weakly connected parts of the software project;
• and
• performing, by a second compute instance, a second program analysis of a second part of the plurality of weakly connected parts of the software project, wherein the second program analysis is performed at least partially in parallel with the first program analysis;
• and
• transmit, to an electronic device, the security risk value for the code commit.