NVIDIA Corporation
DETECTING VULNERABILITIES TO FAULT INJECTION IN COMPUTER CODE USING MACHINE LEARNING

Abstract:

A code analyzer implements machine learning to detect vulnerabilities in computer code. The code analyzer trains a machine learning model using training vectors that characterize vulnerable programming patterns. The code analyzer evaluates a topological representation of the computer code using the machine learning model to identify a potential vulnerability. The potential vulnerability corresponds to a portion of the computer code where an attack can be used to bypass a security procedure. The code analyzer tests the potential vulnerability by emulating a fault injection during execution of the portion of the computer code. Upon confirming that the potential vulnerability can be exploited via a fault injection, the code analyzer generates a training vector that characterizes a vulnerable programming pattern associated with the portion of the computer code. The training vector can be used to further train the machine learning model.