Back to results
US 12,694,131 B1Granted
Comprehensive suite for advanced real-time code analysis and security
AssigneeDryRun Security Co.
InventorsJames Wickett, Kenny Russell Johnson
Life of this patent
Estimating the term…
Abstract
The disclosed technology pertains to the detection of security vulnerabilities in proposed changes to a codebase. Upon receiving a proposed change, the system determines a code context based on the data and metadata of the changed files. The proposed change is then divided into code segments processed by multiple code analyzers in parallel, each focusing on specific security concerns. The system can utilize large language models (LLMs) to enhance the analysis, providing more accurate and comprehensive detection of vulnerabilities. Furthermore, the system can present to a user a user interface comprising security information and answers to one or more natural-language security questions.
Claims22
At least one non-transitory, computer-readable storage medium comprising instructions recorded thereon, wherein the instructions, when executed by at least one data processor of a system, cause the system to:
- receive a proposed change to a codebase,
- wherein the codebase comprises a collection of files including texts written in one or more programming languages,
- wherein the proposed change comprises one or more changes to one or more files in the codebase;
- determine a code context for the proposed change based on at least a file type of the one or more files or a programming language used in the one or more files,
- wherein the code context corresponds to an application type of the codebase, and
- wherein the application type is associated with a set of known security vulnerabilities;
- split, by a plurality of code analyzers and based on the code context, the proposed change into code segments,
- wherein each of the plurality of code analyzers is configured to analyze a specific aspect of security concerns, and
- wherein each of the plurality of code analyzers is configured to split the proposed change into a corresponding set of code segments according to a corresponding aspect of security concerns;
- and
- detect whether a security vulnerability exists in the proposed change by using the plurality of code analyzers to analyze corresponding sets of code segments in parallel.
8 more elements
A system comprising:
- at least one processor;
- and
- at least one memory storing instructions that, when executed by the at least one processor, cause the system to:
- identify a first set of security analysis reports,
- wherein each security analysis report corresponds to a security analysis performed on a first proposed change for a first codebase,
- wherein the first proposed change comprises one or more changes to one or more files in the first codebase, and
- wherein each security analysis report comprises output from each of a set of code analyzers used to detect potential security vulnerabilities in the first proposed change;
- generate, based on the first set of security analysis reports, a first change request security summary;
- generate, based on a second set of security analysis reports corresponding to a second security analysis performed on a second proposed change for a second codebase, a second change request security summary;
- and
- determine a code context for at least one of the first or second proposed changes based on at least a file type of the one or more files or a programming language used in the one or more files,
- wherein the code context includes an indication of an application type of the codebase,
- wherein the application type is associated with a set of known security vulnerabilities;
- and wherein the set of code analyzers analyze at least one of the first or second proposed changes, using the code context;
- generate, from the first and second change request security summaries, an awareness digest;
- wherein the awareness digest identifies security vulnerabilities, detected in both the first and second proposed changes, associated with a particular security concern.
13 more elements
A computer-implemented method, comprising:
- receiving a proposed change for a codebase,
- wherein the codebase comprises a collection of files including texts written in one or more programming languages,
- wherein the proposed change comprises one or more changes to one or more files in the codebase;
- determining an application type of the codebase,
- wherein the application type is associated with a set of known security vulnerabilities, and
- wherein the application type is determined based on at least one of:
- a file type of the one or more files in the codebase, a programming language used in the one or more files in the codebase, a code dependency used by the one or more files in the codebase, or a user who made one or more changes included in the proposed change to the codebase;
- determining a code context for the proposed change, wherein the code context includes the application type associated with the set of known security vulnerabilities;
- generating, by a plurality of code analyzers, sets of code segments,
- wherein each code segment contains text from the proposed change,
- wherein each of the plurality of code analyzers is configured to generate a corresponding set of code segments;
- and
- detecting a security vulnerability in the proposed change by using the plurality of code analyzers to analyze corresponding sets of code segments in parallel.
10 more elements
At least one non-transitory, computer-readable storage medium comprising instructions recorded thereon, wherein the instructions, when executed by at least one data processor of a system, cause the system to:
- receive a proposed change for a codebase comprising a collection of files including text written in one or more programming languages,
- wherein the proposed change comprises one or more changes to one or more files in the codebase;
- receive a code context for the proposed change,
- wherein a code context is determined based on at least a file type of the one or more files or a programming language used in the one or more files,
- wherein the code context corresponds to an application type of the codebase that is associated with a set of known security vulnerabilities;
- split the proposed change into a set of code segments according to the set of known security vulnerabilities that corresponds to the code context;
- and
- providing, to one or more Large Language Models (LLMs), one or more prompts corresponding to the set of known security vulnerabilities;
- supplying, based on a set of initial responses from the one or more LLMs, assistance data for the set of code segments,
- wherein the assistance data comprises at least one of:
- a known vulnerable coding pattern for the set of code segments, or a set of known edge scenarios representing extreme values within a range of possible values;
- and
- determining whether a security vulnerability exists based on a set of updated responses from the one or more LLMs.
10 more elements
Dependencies are inferred from the claim text.