# US 12,602,488 B2 · Identifying security-relevant commits through architectural context > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,602,488 B2 - Document ID: US12602488B2 - Status: Granted - Kind: B2 - Application number: 18/541,608 - Filed: 2023-12-15 - Published: 2025-06-19 - Granted: 2026-04-14 - Earliest claimed: 2023-12-15 - Assignees: Sap SE - Applicants: Sap SE - Inventors: Antonino Sabetta; Rocio Cabrera Lozoya - Web page: https://patentgrep.com/patent/US12602488B2 ## CPC - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 8/71: Version control (security arrangements therefor G06F21/57); Configuration management - G06F 21/51: at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability - G06F 21/563: {by source code analysis} - G06N 3/044: Recurrent networks, e.g. Hopfield networks - G06N 3/045: Combinations of networks - G06N 3/08: Learning methods - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Security-relevant commits are important to identify because they may provide an opportunity for a malicious party to identify vulnerabilities in the software that a malicious party can take advantage of. Methods and apparatuses are described herein combine the commit with information related to the architectural context in which those changes appear to predict the likelihood that a given commit contains security-relevant software code changes. The security-relevent code changes may be code changes to fix an existing security risk or code changes that may introduce a potential security risk. ## Claims ### Claim 1 A method comprising: receiving a source code commit, the source code commit including at least one source code change to a source code repository and a message in natural language describing the at least one source code change; generating a message vector based on the message; generating a commit vector based on the at least one source code change; generating an architecture-aware commit vector based on the at least one source code change and an annotated architecture model of the source code repository, wherein generating the architecture-aware commit vector includes: identifying an architecture element in the annotated architecture model that is associated with the at least one source code change, wherein at least one annotation of the annotated architecture model identifies at least one architecture element in the architecture model that is a potential security risk and includes security-related information; extracting at least one path in the annotated architecture model that passes through the architecture element; and aggregating the at least one extracted path to generate the architecture-aware commit vector; and processing, through a multiple input neural network model, the message vector, the commit vector, and the architecture-aware commit vector to determine a likelihood that the at least one source code change creates a potential security risk. ### Claim 2 (depends on 1) The method as in claim 1, wherein generating the message vector includes processing the message through a natural language model. ### Claim 3 (depends on 1) The method as in claim 1, wherein generating the commit vector includes processing the at least one source code change through a second neural network model. ### Claim 4 (depends on 1) The method as in claim 1, wherein generating the architecture-aware commit vector further includes: extracting a source code tree from the source code repository; generating an architecture model from the source code tree; and annotating the architecture model to identify at least one architecture element in the architecture model that is a potential security risk. ### Claim 5 (depends on 1) The method as in claim 1, wherein the at least one extracted path connects two terminal nodes in the annotated architecture model. ### Claim 6 (depends on 4) The method as in claim 4, further comprising updating the annotated architecture model according to the at least one source code change. ### Claim 7 (depends on 1) The method as in claim 1, wherein aggregating the at least one extracted path includes encoding each path of the at least one extracted path to generate a corresponding vector representation. ### Claim 8 (depends on 7) The method as in claim 7, wherein aggregating the at least one extracted path further includes aggregating the vector representations that correspond to the at least one extracted path. ### Claim 9 A system comprising: one or more processors; a non-transitory computer-readable medium storing a program executable by the one or more processors, the program comprising sets of instructions for: receiving a source code commit, the source code commit including at least one source code change to a source code repository and a message in natural language describing the at least one source code change; generating a message vector based on the message; generating a commit vector based on the at least one source code change; generating an architecture-aware commit vector based on the at least one source code change and an annotated architecture model of the source code repository, wherein generating the architecture-aware commit vector includes: identifying an architecture element in the annotated architecture model that is associated with the at least one source code change, wherein at least one annotation of the annotated architecture model identifies at least one architecture element in the architecture model that is a potential security risk and includes security-related information; extracting at least one path in the annotated architecture model that passes through the architecture element; and aggregating the at least one extracted path to generate the architecture-aware commit vector; and processing, through a multiple input neural network model, the message vector, the commit vector, and the architecture-aware commit vector to determine a likelihood that the at least one source code change creates a potential security risk. ### Claim 10 (depends on 9) The system of claim 9, wherein generating the architecture-aware commit vector further includes: extracting a source code tree from the source code repository; generating an architecture model from the source code tree; and annotating the architecture model to identify at least one architecture element in the architecture model that is a potential security risk. ### Claim 11 (depends on 9) The system of claim 9, wherein the program further comprises sets of instructions for updating the annotated architecture model according to the at least one source code change. ### Claim 12 (depends on 9) The system of claim 9, wherein aggregating the at least one extracted path includes encoding each path of the at least one extracted path to generate a corresponding vector representation. ### Claim 13 (depends on 12) The system of claim 12, wherein aggregating the at least one extracted path further includes aggregating the vector representations that correspond to the at least one extracted path. ### Claim 14 A non-transitory computer-readable medium storing a program executable by one or more processors, the program comprising sets of instructions for: receiving a source code commit, the source code commit including at least one source code change to a source code repository and a message in natural language describing the at least one source code change; generating a message vector based on the message; generating a commit vector based on the at least one source code change; generating an architecture-aware commit vector based on the at least one source code change and an annotated architecture model of the source code repository, wherein generating the architecture-aware commit vector includes: identifying an architecture element in the annotated architecture model that is associated with the at least one source code change, wherein at least one annotation of the annotated architecture model identifies at least one architecture element in the architecture model that is a potential security risk and includes security-related information; extracting at least one path in the annotated architecture model that passes through the architecture element; and aggregating the at least one extracted path to generate the architecture-aware commit vector; and processing, through a multiple input neural network model, the message vector, the commit vector, and the architecture-aware commit vector to determine a likelihood that the at least one source code change creates a potential security risk. ### Claim 15 (depends on 14) The non-transitory computer-readable medium of claim 14, wherein generating the architecture-aware commit vector further includes: extracting a source code tree from the source code repository; generating an architecture model from the source code tree; and annotating the architecture model to identify at least one architecture element in the architecture model that is a potential security risk. ### Claim 16 (depends on 15) The non-transitory computer-readable medium of claim 15, further comprising updating the architecture model according to the at least one source code change. ### Claim 17 (depends on 14) The non-transitory computer-readable medium of claim 14, wherein aggregating the at least one extracted path includes encoding each path of the at least one extracted path to generate a corresponding vector representation. ### Claim 18 (depends on 1) The method of claim 1, wherein the at least one annotation of the annotated architecture model identifies that the architecture element is a source or sink of sensitive data, a data storage element, a component or communication channel that is protected by authentication, or authorization, or encryption, and a channel that crosses a trust boundary.