Graph-based source code vulnerability detection system

A graph-based source code vulnerability detection system, comprising:

• a vulnerability mining module that:
• identifies a vulnerable source code function having a vulnerability;
• and
• identifies a patched source code function representing the vulnerable source code function with the vulnerability having been patched;
• a graph generation module that:
• generates a vulnerable code graph of the vulnerable source code function;
• generates a patched code graph of the patched source code function;
• and
• generates a target code graph of target source code;
• a triplet sampling module that:
• converts the vulnerable code graph into vulnerable code property triplets;
• converts the patched code property graph into patched code property triplets;
• and
• converts the target code property graph into target triplets;
• a vulnerability graph generation module that compares the vulnerable code property triplets and the patched code property triplets to generate:
• positive triplets, found in the vulnerable code graph, that are not found in the patched code graph;
• negative triplets, found in the patched code graph, that are not found in the vulnerable code graph;
• and
• context triplets found in both the vulnerable code graph and the patched code graph;
• and
• a triplet matcher that determines whether the target source code is likely to have the vulnerability by comparing the target triplets to the positive triplets, the negative triplets, and the context triplets.

Non-transitory computer readable storage media (CRSM) storing instructions that, when executed by a computer processor, cause a graph-based source code vulnerability detection system to:

• identify a vulnerable source code function having a vulnerability;
• identify a patched source code function representing the vulnerable source code function with the vulnerability having been patched;
• generate a vulnerable code graph of the vulnerable source code function;
• generate a patched code graph of the patched source code function;
• convert the vulnerable code graph into vulnerable code property triplets;
• convert the patched code property graph into patched code property triplets;
• compare the vulnerable code property triplets and the patched code property triplets to generate a vulnerability graph comprising:
• positive triplets, found in the vulnerable code graph, that are not found in the patched code graph;
• negative triplets, found in the patched code graph, that are not found in the vulnerable code graph;
• and
• context triplets found in both the vulnerable code graph and the patched code graph;
• generate a target code graph of target source code;
• convert the target code property graph into target triplets;
• determine whether the target source code is likely to have the vulnerability by comparing the target triplets to the positive triplets, the negative triplets, and the context triplets.