Systems and methods for detecting vulnerabilities in software in real time

A method for detecting vulnerabilities in software in real time, comprising:

• receiving a training dataset, comprising first source code, first runtime data flow, and a first set of sample vulnerable libraries associated with the first source code;
• using the training dataset, training a vulnerability detection model to detect vulnerable software libraries in the first source code;
• receiving second source code being tested in a development environment;
• collecting, through the development environment, the second source code and second runtime data flow associated with the second source code;
• processing the second source code and the second runtime data flow using the vulnerability detection model to identify a set of novel vulnerable software libraries and a set of known vulnerable software libraries in the second source code, wherein the set of novel vulnerable software libraries is not in the first set of sample vulnerable libraries, and wherein the set of known vulnerable software libraries is in the first set of sample vulnerable libraries and used in training the vulnerability detection model;
• generating a set of replacement libraries to replace the set of known vulnerable software libraries and the set of novel vulnerable software libraries;
• and
• for each vulnerable library in the set of novel vulnerable software libraries and the set of known vulnerable software libraries, in response to detecting a replacement library in the set of replacement libraries, replacing the vulnerable library with an associated replacement library.

One or more non-transitory, computer-readable media comprising instructions that, when executed by one or more processors, cause operations comprising:

• receiving a vulnerability detection model trained to detect vulnerable software libraries in source code;
• receiving first source code being tested in a development environment;
• collecting, through the development environment, the first source code and first runtime data flow associated with the first source code;
• processing the first source code and the first runtime data flow using the vulnerability detection model to identify a set of novel vulnerable software libraries and a set of known vulnerable software libraries in the first source code, wherein the set of novel vulnerable software libraries is not in used in training the vulnerability detection model, and wherein the set of known vulnerable software libraries is used in training the vulnerability detection model;
• generating a first set of replacement libraries to replace the set of known vulnerable software libraries;
• generating confidence scores associated with the set of novel vulnerable software libraries, wherein the confidence scores are indicative of a likelihood of a software library being vulnerable;
• generating a second set of replacement libraries to replace the set of known vulnerable software libraries and the set of novel vulnerable software libraries;
• and
• for each vulnerable library in the set of novel vulnerable software libraries and the set of known vulnerable software libraries, in response to detecting a replacement library in the first set of replacement libraries or the second set of replacement libraries, replacing the vulnerable library with an associated replacement library.