System and method for prioritizing code violations using machine learning and datasets of vulnerable and vanilla code snippets

#The present disclosure relates to software development and cybersecurity. More specifically, it pertains to a system and method for prioritizing code violations using machine learning and datasets of vulnerable and vanilla code snippets.

#In software development, identifying and fixing code violations is a critical task. However, the severity of these violations can vary significantly, and addressing minor bugs while leaving dangerous errors unattended can lead to severe consequences. Existing methods for prioritizing code violations often lack the ability to differentiate between minor and severe violations, leading to inefficient use of developer resources and potential security risks. Therefore, there is a need for a system that can prioritize the most critical violations for correction.

#Code violations refer to cases where the code fails to follow coding standards, best practices, or security rules that have been put in place. These violations can show up as defects, performance problems, or security gaps that have the potential to negatively impact the function, dependability, or safety of the software application. Detecting and resolving violations is a vital part of the software development lifecycle, as it helps guarantee that the end product delivered is high-quality, secure, and performs efficiently. By adhering to established guidelines and addressing any violations, developers can create robust and reliable software that meets functionality, security, and efficiency needs.

#A more complete appreciation of the disclosure, and many of the attendant features and aspects thereof, will become more readily apparent as the disclosure becomes better understood by reference to the following detailed description when considered in conjunction with the accompanying drawings in which like reference symbols indicate like components.

#FIG. 1 shows an exemplary process for vulnerable dataset creation, according to some embodiments of the disclosure.

#FIG. 2 depicts an exemplary process for vanilla dataset creation, according to some embodiments of the disclosure.

#The present disclosure provides a system and method for prioritizing code violations using machine learning and datasets of vulnerable and vanilla code snippets. In some embodiments, the system trains a machine learning (ML) model on a dataset containing two types of code snippets: “vulnerable” and “vanilla” code snippets to prioritize code violations that differentiates coding errors that can potentially lead to serious vulnerabilities. “Vulnerable” code snippets are past coding errors that have caused security issues, while “vanilla” code snippets are clean code samples without any flaws. The model assigns a “vulnerability probability” score to each code snippet to help prioritize the most critical issues for correction. This score measures the code snippet's similarity to verified vulnerability-causing mistakes, thus it helps prioritize the most critical issues for correction. The present disclosure thus provides a more efficient and effective method for prioritizing code violations, optimizing the use of developer resources, and enhancing the security of software applications.

#The disclosure also describes a systematic approach to creating the “vulnerable” and “vanilla” datasets. In some embodiments, the vulnerable dataset is created from GitHub commit hashes found in the Common Vulnerabilities and Exposures (CVE) dataset that provides a reference method for publicly known information-security vulnerabilities and exposures, while the “vanilla” dataset is created from open-source projects using static analysis tools, such as Parasoft's™ Jtest™, dotTEST™ and C/C++Test™ to analyze the code and filter out any functions or methods with violations.

#As known in the art, similar to saving a file that's been edited, a “commit” records changes to one or more files in a code branch. Git assigns each commit a unique ID, called a SHA or hash, that identifies the specific changes, when the changes were made, and who created the changes. When a commit is made, a commit message that briefly describes the changes must be included.