# US 2024/0202099 A1 · Analysis device and method for detecting variable vulnerability in software using machine learning model > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2024/0202099 A1 - Document ID: US20240202099A1 - Status: Published application - Kind: A1 - Application number: 18/368,833 - Filed: 2023-09-15 - Published: 2024-06-20 - Earliest claimed: 2022-12-15 - Assignees: Ewha University-Industry Collaboration Foundation - Applicants: Ewha University-Industry Collaboration Foundation - Inventors: Byoung Ju CHOI; Ji Hyun PARK - Web page: https://patentgrep.com/patent/US20240202099A1 ## CPC - G06F 11/3612: {by runtime analysis (performance monitoring G06F11/3466)} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 11/3624: {by performing operations on the source code, e.g. via a compiler} - G06F 11/3636: {by tracing the execution of the program} - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/562: {Static detection} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Provided are a device and method for detecting a variable vulnerability in software using a machine learning (ML) model. The method performed by an analysis device includes receiving a source code of a program to be analyzed, replacing call functions, variable names, and call stack functions in an execution log generated during execution of the source code with certain identifiers (IDs) to preprocess the execution log, analyzing the preprocessed execution log through a pretrained first learning model to classify whether each pair of a global variable and a call function is at an initialization location, analyzing the preprocessed execution log through a pretrained second learning model to estimate a maximum value and a minimum value of the global variable, and determining whether the global variable is vulnerable on the basis of information output by the first learning model and information output by the second learning model. ## Claims ### Claim 1 A method of detecting a variable vulnerability in software using a machine learning model, the method comprising: receiving, by an analysis device, a source code of a program to be analyzed; replacing, by the analysis device, call functions, variable names, and call stack functions in an execution log which is generated during execution of the source code, with certain identifiers (IDs) to preprocess the execution log; analyzing, by the analysis device, the preprocessed execution log through a pretrained first learning model to classify whether each pair of a global variable and a call function is at an initialization location; analyzing, by the analysis device, the preprocessed execution log through a pretrained second learning model to estimate a maximum value and a minimum value of the global variable; and determining, by the analysis device, whether the global variable is vulnerable on the basis of (i) whether the global variable has been initialized or an initialization location of the global variable determined according to a classification result of the first learning model and (ii) information output by the second learning model. ### Claim 2 (depends on 1) The method of claim 1, wherein the analysis device determines whether the variable has been used or a change trend of variable values on the basis of the information output by the second learning model, and determines whether the global variable is vulnerable using at least one of whether the global variable has been initialized, the initialization location of the global variable, and the change trend of variable values. ### Claim 3 (depends on 1) The method of claim 1, wherein the analysis device determines a vulnerability of the global variable to be any one of (i) initialization during use of a variable, (ii) a variable value outside a permissible range, and (iii) use of an uninitialized variable. ### Claim 4 (depends on 1) The method of claim 1, further comprising statically analyzing, by the analysis device, the source code before preprocessing of the execution log to extract initial values of variables, a list of functions, and call relationships between the functions. ### Claim 5 (depends on 1) The method of claim 1, if an initial value of the global variable is changed during the execution, and a function which changes the initial value is not an initialization function, the analysis device determines the global variable to be a defect of initialization during use of the global variable. ### Claim 6 (depends on 1) The method of claim 1, wherein, when a variable value of the global variable deviates from a maximum value or a minimum value of a data type of the global variable during the execution, the analysis device determines the global variable to be a defect. ### Claim 7 (depends on 1) The method of claim 1, wherein, when the global variable is used by a function other than an initialization function without being initialized, the analysis device determines the global variable to be a defect. ### Claim 8 An analysis device for detecting a variable vulnerability in software, the analysis device comprising: an interface device configured to receive a source code of a program to be analyzed; a storage device configured to store a first learning model for classifying an initialization location of a global variable and a second learning model for estimating a maximum value and a minimum value of the global variable; and a arithmetic device configured to preprocess an execution log generated during execution of the source code by replacing call functions, variable names, and call stack functions in the execution log with certain identifiers (IDs) and determine whether the global variable is vulnerable on the basis of whether the global variable included in the execution log has been initialized or the initialization location of the global variable which is determined by inputting the preprocessed execution log to the first learning model, and information determined by inputting the preprocessed execution log to the second learning model. ### Claim 9 (depends on 8) The analysis device of claim 8, wherein the arithmetic device determines whether the variable has been used or a change trend of variable values on the basis of the information output by the second learning model, and determines whether the global variable is vulnerable using at least one of whether the global variable has been initialized, the initialization location of the global variable, and the change trend of variable values. ### Claim 10 (depends on 8) The analysis device of claim 8, wherein the arithmetic device determines a vulnerability of the global variable to be any one of (i) initialization during use of a variable, (ii) a variable value outside a permissible range, and (iii) use of an uninitialized variable.