Discovery of novel vulnerabilities in software packages on version control platforms
AssigneeTrend Micro Incorporated
InventorsDeep Chandubhai Patel, Pawan Kinger, Ashish Verma
Life of this patent
Estimating the term…
Abstract
Novel vulnerabilities in Open-Source Software (OSS) packages are identified from comments made on repositories of a version control platform. Security-related comments are identified and converted into a conversation format, such as a dialog. A prompt that includes the dialog is created and input to a generative Artificial Intelligence (AI) model. The prompt includes instructions that guide the AI model in generating an output. The output indicates whether a component of an OSS package has a vulnerability.
Claims16
A method of discovering novel vulnerabilities in Open-Source Software (OSS) packages on a version control platform, the method comprising:
- receiving a plurality of comments on pull requests or commits from the version control platform, the plurality of comments being made on repositories of the OSS packages on the version control platform;
- identifying security-related comments from among the plurality of comments, the security-related comments are made on a repository of an OSS package;
- converting the security-related comments to a conversation format to create a dialog;
- creating a prompt that includes the dialog;
- inputting the prompt to a generative artificial intelligence (AI) model;
- receiving, from the generative AI model, an output that is responsive to the prompt;
- and
- raising an alert in response to the output from the AI model indicating that the security-related comments indicate a vulnerability in the OSS package.
A system comprising:
- a version control platform having a plurality of repositories;
- and
- a backend system comprising at least one processor and a memory, the memory of the backend system storing instructions that when executed by the at least one processor of the backend system cause the backend system to:
- receive comments on a pull request or a commit of a repository of the plurality of repositories of the version control platform, the repository storing components of an Open-Source Software (OSS) package;
- determine that the comments are security-related;
- convert the comments to a dialog;
- generate a prompt that includes the dialog;
- input the prompt to a generative artificial intelligence (AI) model to receive an output from the AI model;
- and
- raise an alert in response to the output from the generative AI model indicating a vulnerability in the OSS package.
A method of discovering novel vulnerabilities in Open-Source Software (OSS) packages on a version control platform, the method comprising:
- receiving a comment thread of a pull request or a commit from the version control platform, the comment thread including a plurality of comments on a repository of an OSS package;
- identifying security-related comments from among the plurality of comments;
- converting the security-related comments to a dialog;
- creating a prompt that includes the dialog and an instruction to a generative artificial intelligence (AI) model to output a binary response;
- inputting the prompt to the generative AI model;
- receiving, from the generative AI model, an output that includes the binary response;
- and
- raising an alert in response to the binary response from the generative AI model indicating a vulnerability in the OSS package.
Dependencies are inferred from the claim text.