Comprehensive suite for advanced real-time code analysis and security
AssigneeDryRun Security Co.
InventorsJames Wickett, Kenny Russell Johnson
Life of this patent
Estimating the term…
Abstract
The disclosed technology pertains to the detection of security vulnerabilities in proposed changes to a codebase. Upon receiving a proposed change, the system determines a code context based on the data and metadata of the changed files. The proposed change is then divided into code segments processed by multiple code analyzers in parallel, each focusing on specific security concerns. The system can utilize large language models (LLMs) to enhance the analysis, providing more accurate and comprehensive detection of vulnerabilities. Furthermore, the system can present to a user a user interface comprising security information and answers to one or more natural-language security questions.
Claims20
At least one non-transitory, computer-readable storage medium comprising instructions recorded thereon, wherein the instructions, when executed by at least one data processor of a system, cause the system to:
- receive a proposed change to a codebase,
- wherein the codebase comprises a collection of files including texts written in one or more programming languages,
- wherein the proposed change comprises one or more changes to one or more files in the codebase;
- determine a code context for the proposed change based on at least a file type of the one or more files or a programming language used in the one or more files,
- wherein the code context corresponds to an application type of the codebase, and
- wherein the application type is associated with a set of known security vulnerabilities;
- split, by a plurality of code analyzers and based on the code context, the proposed change into code segments,
- wherein each of the plurality of code analyzers is configured to analyze a specific aspect of security concerns, and
- wherein each of the plurality of code analyzers is configured to split the proposed change into a corresponding set of code segments according to a corresponding aspect of security concerns, and
- wherein the plurality of code analyzers includes at least one code analyzer that uses a large language model to produce outputs;
- and
- detect whether a security vulnerability exists in the proposed change by using the plurality of code analyzers to analyze corresponding sets of code segments in parallel.
A system comprising:
- at least one processor;
- and
- at least one memory storing instructions that, when executed by the at least one processor, cause the system to:
- identify a first set of security analysis reports,
- wherein each security analysis report corresponds to a security analysis performed on a first proposed change for a first codebase, wherein the first proposed change comprises one or more changes to one or more files in the first codebase,
- wherein each security analysis report comprises output from each of a set of code analyzers used to detect potential security vulnerabilities in the first proposed change, and
- wherein the set of code analyzers includes at least one code analyzer that uses a large language model to produce outputs;
- generate, based on the first set of security analysis reports, a first change request security summary;
- generate, based on a second set of security analysis reports corresponding to a second security analysis performed on a second proposed change for a second codebase, a second change request security summary;
- and
- generate, from the first and second change request security summaries, an awareness digest;
- wherein the awareness digest identifies security vulnerabilities, detected in both the first and second proposed changes, associated with a particular security concern.
A computer-implemented method, comprising:
- receiving a proposed change for a codebase,
- wherein the codebase comprises a collection of files including texts written in one or more programming languages,
- wherein the proposed change comprises one or more changes to one or more files in the codebase;
- determining a code context for the proposed change,
- wherein the code context corresponds to a set of known security vulnerabilities;
- generating, by a plurality of code analyzers, sets of code segments,
- wherein each code segment contains text from the proposed change,
- wherein each of the plurality of code analyzers is configured to generate a corresponding set of code segments, and
- wherein the set of code analyzers includes at least one code analyzer that uses a large language model to produce outputs;
- and
- detecting a security vulnerability in the proposed change by using the plurality of code analyzers to analyze corresponding sets of code segments in parallel.
Dependencies are inferred from the claim text.