Leveraging generative artificial intelligence to identify and verify vulnerability patterns within vulnerable dependencies

A non-transitory computer-readable medium comprising memory with instructions encoded thereon, the instructions, when executed by one or more processors, causing the one or more processors to perform operations, the instructions comprising instructions to:

• receive a vulnerability alert;
• input the vulnerability alert and associated code from a software package into a generative artificial intelligence model, the generative artificial intelligence model primed to receive a given vulnerability alert and identify a location within the associated code having a given vulnerability pattern;
• receive, as output from the generative artificial intelligence model, a vulnerability pattern within a subset of the associated code and an explanation of why the vulnerability pattern matches the vulnerability alert;
• perform a secondary verification that the vulnerability pattern matches the vulnerability alert;
• and
• responsive to success of the secondary verification, perform a reachability analysis of the vulnerability pattern with respect to an application having the software package as a dependency.

A system comprising:

• memory with instructions encoded thereon;
• and
• one or more processors that, when executing the instructions, are caused to perform operations comprising:
• receiving a vulnerability alert;
• inputting the vulnerability alert and associated code from a software package into a generative artificial intelligence model, the generative artificial intelligence model primed to receive a given vulnerability alert and identify a location within the associated code having a given vulnerability pattern;
• receiving, as output from the generative artificial intelligence model, a vulnerability pattern within a subset of the associated code and an explanation of why the vulnerability pattern matches the vulnerability alert;
• performing a secondary verification that the vulnerability pattern matches the vulnerability alert;
• and
• responsive to success of the secondary verification, performing a reachability analysis of the vulnerability pattern with respect to an application having the software package as a dependency.