Remediating software vulnerabilities

A computer implemented method of remediating an increased vulnerability of a software system including a plurality of software components, the method comprising:

• accessing data records each corresponding to a known software vulnerability, each data record including an identification of one or more software components affected by the known software vulnerability;
• generating, for each of at least a subset of the data records, one or more training data items for a neural network, each training data item associating a vulnerability of the data record with affected software components identified by the data record, the neural network having input units corresponding to items in a corpus of all software components and output units corresponding to items in a corpus of all vulnerabilities;
• training the neural network using the training data so as to define a vector representation for each software component in the corpus of all software components based on weights in the neural network for an input unit corresponding to the software component;
• aggregating, for a subset of software components in the corpus corresponding to software components in the software system, vector representations for each software component in the subset to an aggregate vector representation for the software system for the particular time;
• repeating the accessing, the generating, the augmenting, the training and the aggregating at a subsequent time to generate multiple generations of aggregate vector representations for the software system, each generation corresponding to data records accessed at a different time;
• comparing the multiple generations of aggregate vector representations for the software system to detect a change in one or more aggregate vector representation exceeding a maximum threshold degree of change as an indication of an increased vulnerability of the software system;
• and
• responsive to the indication of an increased vulnerability, iteratively adjusting the software components in the software system and, at each iteration, regenerating an aggregate vector representation for the software system so adjusted, and comparing each regenerated aggregate vector representation with the multiple generations of aggregate vector representations to identify a software component adjustment leading to a change in vector representation not exceeding the maximum threshold degree of change so as to reduce the vulnerability of the software system.