Data Study Group Final Report: Dstl

Can machine learning be used to identify code vulnerabilities?

Software security is granted by the absence of bugs and weaknesses in code. As software becomes increasingly complex, often consisting of millions of lines of code, checking the code for errors becomes very costly. Despite existing static analysis tools, a high false-positive rate means this has a large manual overhead, since it is difficult to demonstrate the absence of a bug in code.

This project investigated how to use machine learning algorithms to improve on existing automated vulnerability discovery tools. This could be used to inform the development of new tools to be used alongside existing static analysis methods and formal verification where appropriate.