GitHub's code analysis technology based on CodeQL has been revamped and now uses machine learning (ML) to find potential security vulnerabilities in code.

GitHub acquired the technology for CodeQL as part of the acquisition of Semmie. CodeQL is used by security research teams to perform semantic analysis of code, and was made open source by GitHub.

CodeQL works by building a database that contains a relational representation of the code, then queries are run on the database to look for particular security problems. The queries are based on the patterns of known security problems, and building the patterns takes time.

GitHub's Tiferet Gazit said:

"Manual modeling can be time-consuming, and there will always be a long tail of less-common libraries and private code that we won’t be able to model manually. This is where machine learning comes in."

The CodeQL team uses examples that have been recognized using the manual models to train deep learning neural networks that can determine whether a code snippet comprises a potentially risky sink.

This means CodeQL can uncover security vulnerabilities even when they arise from the use of a library the team has never seen before. For example, CodeQL can detect SQL injection vulnerabilities in the context of lesser-known or closed-source database abstraction libraries.

In terms of accuracy, the team says their testing of CodeQL on repositories that were not included in the training set, and comparing the alerts detected by machine learning and a manual query created by a security expert, on average they measured a recall of approximately 80% with a precision of approximately 60%.

The team is currently extending ML-generated alerts to more JavaScript and Typescript security queries, as well as working to improve both their performance and their runtime. Future plans include expansion to more programming languages.

More Information

GitHub code scanning

Related Articles

GitHub Code Scanning Generally Available

GitHub Strengthens Team Working

New From GitHub Universe

GitHub Launches Actions

Microsoft Buys GitHub - Get Ready For a Bigger Devil

To be informed about new articles on I Programmer, sign up for our weekly newsletter, subscribe to the RSS feed and follow us on Twitter, Facebook or Linkedin.

Comments

Make a Comment or View Existing Comments Using Disqus

or email your comment to: comments@i-programmer.info