Source code vulnerability detection using deep learning

A system comprising:

• one or more processors;
• and
• at least one memory storing processor-executable instructions that, when executed by any one or more of the one or more processors, causes the one or more processors to perform operations comprising:
• receive a source code file;
• match source code from the source code file to a plurality of program slices by parsing the source code and mapping a portion of the source code to a program slice of the plurality of program slices, wherein the program slice comprises a program statement associated with a vulnerability;
• generate, using a predictive machine learning model, a vulnerability prediction for the source code file, the vulnerability prediction comprising:
• (a) a location of vulnerable code in the source code based on the matching, and (b) a vulnerability class, of a plurality of vulnerability classes, associated with the vulnerable code in the source code, wherein:
• (i) the vulnerability prediction indicates whether the source code file increases a susceptibility to a malicious attack, (ii) the predictive machine learning model comprises a multiclass classification machine learning model and is trained based on a training dataset, and (iii) the training dataset is generated by:
• (1) receiving a plurality of training source code files and the plurality of vulnerability classes associated with the plurality of training source code files,
• (2) receiving a plurality of syntax features corresponding to the plurality of vulnerability classes,
• (3) determining a program slicing criterion based on the plurality of syntax features,
• (4) extracting a set of program slices from the plurality of training source code files based on the program slicing criterion, wherein one or more program slices of the set of program slices is extracted by performing a forward slice or a backward slice, and
• (5) labeling the set of program slices with the plurality of vulnerability classes;
• and
• initiate one or more prediction-based actions based on the vulnerability prediction.

One or more non-transitory computer-readable storage media including instructions that, when executed by one or more processors, cause the one or more processors to:

• receive a source code file;
• match source code from the source code file to a plurality of program slices by parsing the source code and mapping a portion of the source code to a program slice of the plurality of program slices, wherein the program slice comprises a program statement associated with a vulnerability;
• generate, using a predictive machine learning model, a vulnerability prediction for the source code file, the vulnerability prediction comprising:
• (a) a location of vulnerable code in the source code based on the matching, and (b) a vulnerability class, of a plurality of vulnerability classes, associated with the vulnerable code in the source code, wherein:
• (i) the vulnerability prediction indicates whether the source code file increases a susceptibility to a malicious attack, (ii) the predictive machine learning model comprises a multiclass classification machine learning model and is trained based on a training dataset, and (iii) the training dataset is generated by:
• (1) receiving a plurality of training source code files and the plurality of vulnerability classes associated with the plurality of training source code files,
• (2) receiving a plurality of syntax features corresponding to the plurality of vulnerability classes,
• (3) determining a program slicing criterion based on the plurality of syntax features,
• (4) extracting a set of program slices from the plurality of training source code files based on the program slicing criterion, wherein one or more program slices of the set of program slices is extracted by performing a forward slice or a backward slice, and
• (5) labeling the set of program slices with the plurality of vulnerability classes;
• and
• initiate one or more prediction-based actions based on the vulnerability prediction.