Deep defect and vulnerability prediction

深层缺陷和脆弱性预测

• 批准号: 505833-2017
• 负责人: Tan, Lin
• 金额: $ 9.11万
• 依托单位: University of Waterloo
• 依托单位国家: 加拿大
• 项目类别: Idea to Innovation
• 财政年份: 2017
• 资助国家: 加拿大
• 起止时间: 2017-01-01 至 2018-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=618831
• 关键词: Deep; defect; vulnerability; prediction

The objective of the proposed project is to build a product based on the patented technology from theapplicant's team on detecting software defects and security vulnerabilities automatically. The proposed productwill help developers deliver high-quality software with speed and agility.The technology, referred to as deep defect and vulnerability prediction, predicts source code regions thatcontain defects and security vulnerabilities, i.e., buggy code regions. A core technique is to leverage deeplearning to automatically learn semantic features for building more accurate prediction models to identifydefects and security vulnerabilities. Similar to a weather forecast system that leverages statistical models topredict a rainy day from abundant weather histories, this technology leverages deep learning to automaticallylearn new defect and vulnerability patterns from software development histories. The learned patterns enablethis technology to detect new classes of defects and vulnerabilities.In addition to research contributions, the potential cost savings for the software industry from the proposedproject will be immense because it will significantly reduce the cost of software development and maintenanceby (1) detecting more defects and vulnerabilities earlier (the earlier they are detected, the less they cost), and (2)improving software development productivity

提议项目的目标是基于申请人团队自动检测软件缺陷和安全漏洞的专利技术构建一个产品。提议的产品将帮助开发人员以快速和敏捷的方式交付高质量的软件。该技术被称为深度缺陷和漏洞预测，预测包含缺陷和安全漏洞的源代码区域，即有bug的代码区域。一项核心技术是利用深度学习来自动学习语义特征，以构建更准确的预测模型来识别缺陷和安全漏洞。类似于利用统计模型从丰富的天气历史中预测雨天的天气预报系统，该技术利用深度学习从软件开发历史中自动学习新的缺陷和漏洞模式。学习的模式使该技术能够检测新的缺陷和漏洞类别。除了研究贡献之外，从提议的项目中为软件行业节省的潜在成本将是巨大的，因为它将通过(1)更早地检测更多的缺陷和漏洞（检测得越早，成本越低），以及(2)提高软件开发的生产力，显著地降低软件开发和维护的成本