Back to results
US 12,602,488 B2Granted
Identifying security-relevant commits through architectural context
AssigneeSap SE
InventorsAntonino Sabetta, Rocio Cabrera Lozoya
Life of this patent
Estimating the term…
Abstract
Security-relevant commits are important to identify because they may provide an opportunity for a malicious party to identify vulnerabilities in the software that a malicious party can take advantage of. Methods and apparatuses are described herein combine the commit with information related to the architectural context in which those changes appear to predict the likelihood that a given commit contains security-relevant software code changes. The security-relevent code changes may be code changes to fix an existing security risk or code changes that may introduce a potential security risk.
Claims18
A method comprising:
- receiving a source code commit, the source code commit including at least one source code change to a source code repository and a message in natural language describing the at least one source code change;
- generating a message vector based on the message;
- generating a commit vector based on the at least one source code change;
- generating an architecture-aware commit vector based on the at least one source code change and an annotated architecture model of the source code repository, wherein generating the architecture-aware commit vector includes:
- identifying an architecture element in the annotated architecture model that is associated with the at least one source code change, wherein at least one annotation of the annotated architecture model identifies at least one architecture element in the architecture model that is a potential security risk and includes security-related information;
- extracting at least one path in the annotated architecture model that passes through the architecture element;
- and
- aggregating the at least one extracted path to generate the architecture-aware commit vector;
- and
- processing, through a multiple input neural network model, the message vector, the commit vector, and the architecture-aware commit vector to determine a likelihood that the at least one source code change creates a potential security risk.
7 more elements
A system comprising:
- one or more processors;
- a non-transitory computer-readable medium storing a program executable by the one or more processors, the program comprising sets of instructions for:
- receiving a source code commit, the source code commit including at least one source code change to a source code repository and a message in natural language describing the at least one source code change;
- generating a message vector based on the message;
- generating a commit vector based on the at least one source code change;
- generating an architecture-aware commit vector based on the at least one source code change and an annotated architecture model of the source code repository, wherein generating the architecture-aware commit vector includes:
- identifying an architecture element in the annotated architecture model that is associated with the at least one source code change, wherein at least one annotation of the annotated architecture model identifies at least one architecture element in the architecture model that is a potential security risk and includes security-related information;
- extracting at least one path in the annotated architecture model that passes through the architecture element;
- and
- aggregating the at least one extracted path to generate the architecture-aware commit vector;
- and
- processing, through a multiple input neural network model, the message vector, the commit vector, and the architecture-aware commit vector to determine a likelihood that the at least one source code change creates a potential security risk.
9 more elements
A non-transitory computer-readable medium storing a program executable by one or more processors, the program comprising sets of instructions for:
- receiving a source code commit, the source code commit including at least one source code change to a source code repository and a message in natural language describing the at least one source code change;
- generating a message vector based on the message;
- generating a commit vector based on the at least one source code change;
- generating an architecture-aware commit vector based on the at least one source code change and an annotated architecture model of the source code repository, wherein generating the architecture-aware commit vector includes:
- identifying an architecture element in the annotated architecture model that is associated with the at least one source code change, wherein at least one annotation of the annotated architecture model identifies at least one architecture element in the architecture model that is a potential security risk and includes security-related information;
- extracting at least one path in the annotated architecture model that passes through the architecture element;
- and
- aggregating the at least one extracted path to generate the architecture-aware commit vector;
- and
- processing, through a multiple input neural network model, the message vector, the commit vector, and the architecture-aware commit vector to determine a likelihood that the at least one source code change creates a potential security risk.
7 more elements
Dependencies are inferred from the claim text.