Detection of vulnerable code

A computer-implemented method for preventing computer program memory buffer overflow comprising:

• applying a machine learning model to at least determine whether a computer program includes vulnerable code, the machine learning model being trained to determine whether the computer program includes vulnerable code based at least on a presence and/or absence of each of a plurality of different traits relating to memory usage by the computer program, the traits being indicative of computer program memory buffer overflow;
• and
• providing an indication that the computer program includes vulnerable code, when the computer program is determined to include vulnerable code;
• wherein:
• the providing comprises at least one of:
• causing the indication to be displayed in a user interface, transmitting the indication to a remote computing system, loading the indication into memory, or storing the indication in physical persistence;
• the machine learning model comprises a random forest decision tree comprising a plurality of nodes including a first child node that corresponds to one subset of computer programs having dynamic sized buffers, a second child node that corresponds to another subset of computer programs having static sized buffers, a third child node depending from the first child node that determines whether the computer program includes signed operations, a fourth child node that depends from the third child node that corresponds to computer programs having signed operations, and a fifth child node that depends from the third child node that corresponds to computer programs having unsigned operations;
• and
• the applying comprises traversing nodes of the random forest decision tree based on which of the plurality of traits are present or absent in the computer program to determine whether the computer program includes one or more vulnerabilities.

A non-transitory computer program product storing instructions which, when executed by at least one data processor forming part of at least one computing device, implement operations comprising:

• applying a machine learning model to at least determine whether a computer program includes vulnerable code, the machine learning model being trained to determine whether the computer program includes vulnerable code based at least on a presence and/or absence of a first trait;
• and
• providing an indication that the computer program includes vulnerable code, when the computer program is determined to include vulnerable code;
• initiating, in response to the provided indication, execution of the computer program;
• and
• collecting runtime information during the execution of the computer program to identify an exact type and/or location of a vulnerability exhibited by the computer program;
• wherein:
• the machine learning model comprises a random forest decision tree having a root node corresponding to memory usage;
• the decision tree comprises a plurality of nodes and is split to include a first child node that corresponds to one subset of computer programs having dynamic sized buffers, a second child node that corresponds to another subset of computer programs having static sized buffers, a third child node that depends from the first node that determines whether the computer program includes signed operations, a fourth child node that depends on the third child node that corresponds to computer programs having signed operations, and a fifth child node that depends on the third child node corresponding to computer programs having unsigned operations;
• and
• the applying comprises traversing nodes of the random forest decision tree based on the presence or absence of the first trait in the computer program to determine whether the computer program includes one or more vulnerabilities.