Scalable source code vulnerability remediation

A method for scalable source code vulnerability remediation, the method comprising:

• receiving, by at least one hardware processor, source code that includes at least one vulnerability;
• receiving, by the at least one hardware processor, remediated code that remediates the at least one vulnerability associated with the source code;
• and receiving, by the at least one hardware processor, further source code that includes at least one further vulnerability;
• determining, by the at least one hardware processor, from a trained machine learning model, for a vulnerable code snippet of the source code, a remediated code snippet to remediate the at least one vulnerability associated with the source code;
• and executing, by the at least one hardware processor, a source code transformer for:
• receiving, from the trained machine learning model, a further remediated code snippet to remediate the at least one further vulnerability associated with the further source code;
• and transforming, by the at least one hardware processor, based on the further remediated code snippet or a modified version of the further remediated code snippet, the further source code to remediate the at least one further vulnerability associated with the further source code;
• and executing, by the at least one hardware processor, a similarity analyzer to determine, based on utilization of an abstract syntax tree and a graph neural network, a similarity between the further remediated code snippet and the modified version of the further remediated code snippet;
• wherein further training of the trained machine learning model is based on the determined similarity wherein the trained machine learning model is trained by:
• tokenizing the vulnerable code snippet into lexical elements, sequence tagging the tokenized lexical elements to identify vulnerability-related components using a supervised annotation schema, and generating, based on the tokenized and sequence tagged vulnerable code snippet, a context-preserving remediated code-snippet by applying transformation rules learned from historical vulnerability-remediation pairs.

A non-transitory computer readable medium having stored thereon machine readable instructions, the machine readable instructions, when executed by at least one hardware processor, cause the at least one hardware processor to:

• receive source code that includes at least one vulnerability;
• receive, by at least one hardware processor, remediated code that remediates the at least one vulnerability associated with the source code;
• and receive, by at least one hardware processor, further source code that includes at least one further vulnerability;
• determine, from a trained machine learning model, for a vulnerable code snippet of the source code, a remediated code snippet to remediate the at least one vulnerability associated with the source code;
• and execute a source code transformer, by the at least one hardware processor, to:
• receive, from the trained machine learning model, a further remediated code snippet to remediate the at least one further vulnerability associated with the further source code;
• and transform, based on the further remediated code snippet or a modified version of the further remediated code snippet, the further source code to remediate the at least one further vulnerability associated with the further source code;
• and execute a similarity analyzer, by the at least one hardware processor, to determine, based on utilization of an abstract syntax tree and a graph neural network, a similarity between the further remediated code snippet and the modified version of the further remediated code snippet;
• wherein further training of the trained machine learning model is based on the determined similarity, wherein the trained machine learning model is trained by:
• tokenizing the vulnerable code snippet into lexical elements, sequence tagging the tokenized lexical elements to identify vulnerability-related components using a supervised annotation schema, and generating, based on the tokenized and sequence tagged vulnerable code snippet, a context-preserving remediated code-snippet by applying transformation rules learned from historical vulnerability-remediation pairs.